Bug#906890: dropbear: CVE-2018-15599

2018-09-02 Thread Salvatore Bonaccorso
Hi Guilhem, On Fri, Aug 24, 2018 at 03:26:12AM +0200, Guilhem Moulin wrote: > On Wed, 22 Aug 2018 at 11:19:37 +0200, Guilhem Moulin wrote: > > On Wed, 22 Aug 2018 at 06:21:27 +0200, Salvatore Bonaccorso wrote: > >> Would you agree and could you instead update dropbear for the next > >> point relea

Bug#906890: dropbear: CVE-2018-15599

2018-08-23 Thread Guilhem Moulin
On Wed, 22 Aug 2018 at 11:19:37 +0200, Guilhem Moulin wrote: > On Wed, 22 Aug 2018 at 06:21:27 +0200, Salvatore Bonaccorso wrote: >> Would you agree and could you instead update dropbear for the next >> point release? > > Makes sense indeed, I'll do that instead. Just for the record, upstream fix

Bug#906890: dropbear: CVE-2018-15599

2018-08-22 Thread Guilhem Moulin
On Wed, 22 Aug 2018 at 06:21:27 +0200, Salvatore Bonaccorso wrote: > Would you agree and could you instead update dropbear for the next > point release? Makes sense indeed, I'll do that instead. Cheers, -- Guilhem. signature.asc Description: PGP signature

Bug#906890: dropbear: CVE-2018-15599

2018-08-21 Thread Salvatore Bonaccorso
Hi Guilhem [adding team@s.d.o to the loop] On Tue, Aug 21, 2018 at 11:30:00PM +0200, Guilhem Moulin wrote: > Control: found -1 2014.65-1+deb8u2 > > Hi Salvatore, > > Wow, you're fast :-) I read the the discussion in the upstream list but > wasn't aware a CVE had been assigned yet. > > Upstrea

Bug#906890: dropbear: CVE-2018-15599

2018-08-21 Thread Guilhem Moulin
Control: found -1 2014.65-1+deb8u2 Hi Salvatore, Wow, you're fast :-) I read the the discussion in the upstream list but wasn't aware a CVE had been assigned yet. Upstream replied “I should have a patch in the next couple of days”, and I'll propose an upload to stretch-security after that. (Ho

Bug#906890: dropbear: CVE-2018-15599

2018-08-21 Thread Salvatore Bonaccorso
Source: dropbear Version: 2016.74-1 Severity: grave Tags: security Forwarded: http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2018q3/002108.html Hi, The following vulnerability was published for dropbear. CVE-2018-15599[0]: | The recv_msg_userauth_request function in svr-auth.c in Dropbear | t