diff options
| author | Emily <vcs@emily.moe> | 2024-07-01 10:21:24 +0100 |
|---|---|---|
| committer | Alyssa Ross <hi@alyssa.is> | 2024-07-01 13:06:28 +0200 |
| commit | e328c86314b0d68638970cd674abb857cda83c35 (patch) | |
| tree | bc7747b26b3a171ca0b1f4c083a4a0fca4979445 /pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch | |
| parent | b31d8c6ce2938599f856ae008d57dd78cf42e974 (diff) | |
openssh_{hpn,gssapi}: add backported security fix patches
Fixes a critical security bug allowing remote code execution as root: <https://www.openssh.com/txt/release-9.8> This may be CVE-2024-6387 (currently embargoed): <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6387> Thanks to upstream and Sam James <sam@gentoo.org> for the backport: <https://github.com/gentoo/gentoo/commit/1633ef45475afb9eea04e9cf27021c9d994af338> Please don’t use these packages on the open internet if you care a lot about security.
Diffstat (limited to 'pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch')
| -rw-r--r-- | pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch b/pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch new file mode 100644 index 0000000000000..7b7fb70380d9f --- /dev/null +++ b/pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch @@ -0,0 +1,19 @@ +https://bugs.gentoo.org/935271 +Backport proposed by upstream at https://marc.info/?l=oss-security&m=171982317624594&w=2. +--- a/log.c ++++ b/log.c +@@ -451,12 +451,14 @@ void + sshsigdie(const char *file, const char *func, int line, int showfunc, + LogLevel level, const char *suffix, const char *fmt, ...) + { ++#ifdef SYSLOG_R_SAFE_IN_SIGHAND + va_list args; + + va_start(args, fmt); + sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL, + suffix, fmt, args); + va_end(args); ++#endif + _exit(1); + } + |