-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 21 May 2023 18:22:05 +0000 Source: libssh Binary: libssh-4 libssh-4-dbgsym libssh-dev libssh-gcrypt-4 libssh-gcrypt-4-dbgsym libssh-gcrypt-dev Architecture: ppc64el Version: 0.9.7-0+deb11u1 Distribution: bullseye-security Urgency: medium Maintainer: ppc64el Build Daemon (ppc64el-osuosl-01) Changed-By: Martin Pitt Description: libssh-4 - tiny C SSH library (OpenSSL flavor) libssh-dev - tiny C SSH library - Development files (OpenSSL flavor) libssh-gcrypt-4 - tiny C SSH library (gcrypt flavor) libssh-gcrypt-dev - tiny C SSH library - Development files (gcrypt flavor) Closes: 1035832 Changes: libssh (0.9.7-0+deb11u1) bullseye-security; urgency=medium . * New upstream security microrelease: - CVE-2023-1667: Authenticated remote DoS. Fix authenticated remote DoS through potential NULL dereference during rekeying with algorithm guessing https://www.libssh.org/security/advisories/CVE-2023-1667.txt - CVE-2023-2283: Client authentication bypass. Fix client authentication bypass in pki_verify_data_signature() in low-memory conditions with OpenSSL backend; gcrypt backend is not affected. https://www.libssh.org/security/advisories/CVE-2023-2283.txt (Closes: #1035832) * Drop 000* patches which were backported from the upstream stable 0.9 branch, now included in this release. Unfuzz 2004-install-static-lib.patch. Checksums-Sha1: bd46bf914cbd430dac539610f44c25b9a6785f98 492128 libssh-4-dbgsym_0.9.7-0+deb11u1_ppc64el.deb bae0da17c1981215b5bad8549a860fdf99e1fd60 203832 libssh-4_0.9.7-0+deb11u1_ppc64el.deb 67fa920c59c7b78da2859bf78f33c0821750248a 260800 libssh-dev_0.9.7-0+deb11u1_ppc64el.deb 3e9b003bd0a054681e8283753559b6202dc7e719 533232 libssh-gcrypt-4-dbgsym_0.9.7-0+deb11u1_ppc64el.deb 0a2f7c0d1cb8f847edf99018262ed80967552502 237308 libssh-gcrypt-4_0.9.7-0+deb11u1_ppc64el.deb 3c0128906c23e3f033b282b0ce74d4be532f1bee 299996 libssh-gcrypt-dev_0.9.7-0+deb11u1_ppc64el.deb a09fb73adedcd8758e7c0dbcb251fc5448abbc7c 9489 libssh_0.9.7-0+deb11u1_ppc64el-buildd.buildinfo Checksums-Sha256: f2b2416892717d3a217c47403f6ee8409cbd0e703ebaa43bd244ed98f1c1a910 492128 libssh-4-dbgsym_0.9.7-0+deb11u1_ppc64el.deb 0e494c733b91ac807402b2d962936bbcdcddf6b71be96fc5fa0786b779bf3acb 203832 libssh-4_0.9.7-0+deb11u1_ppc64el.deb b4b5f909d496b473227256380a1c7e21d874ff36056a9456e5c7bc4696b4459e 260800 libssh-dev_0.9.7-0+deb11u1_ppc64el.deb 13bee80291d34d8729146b0a231a863497dbd5a081475cb5d6664a889d3ed1a6 533232 libssh-gcrypt-4-dbgsym_0.9.7-0+deb11u1_ppc64el.deb 13a38b48eba237109bb03fbe70b276a3b74f65243f9a75ba69d3ff79925f403f 237308 libssh-gcrypt-4_0.9.7-0+deb11u1_ppc64el.deb 214ae99409beff989df8036c81b496c3e31c34786d1820601cb9c4b9e58643b4 299996 libssh-gcrypt-dev_0.9.7-0+deb11u1_ppc64el.deb 456fb906bd5c799ac4865d535e6538ced1757ace0f4dd4cd64c0dde530286dee 9489 libssh_0.9.7-0+deb11u1_ppc64el-buildd.buildinfo Files: 16688530f9224b73889e67cdb5ee260a 492128 debug optional libssh-4-dbgsym_0.9.7-0+deb11u1_ppc64el.deb 4331db8eabafcdbf1b4c8d8219a69c6f 203832 libs optional libssh-4_0.9.7-0+deb11u1_ppc64el.deb df4a7aeaf50afb8c6ac205eb79e0190a 260800 libdevel optional libssh-dev_0.9.7-0+deb11u1_ppc64el.deb 541d6516d42b96d78bbf03e3589085d9 533232 debug optional libssh-gcrypt-4-dbgsym_0.9.7-0+deb11u1_ppc64el.deb 89a5ad77bc38e0e60ca556140dd53d69 237308 libs optional libssh-gcrypt-4_0.9.7-0+deb11u1_ppc64el.deb 715c4cab0d911994f436797d33b7d5a7 299996 libdevel optional libssh-gcrypt-dev_0.9.7-0+deb11u1_ppc64el.deb abecab735fae2e18d3e8f5bd9d982770 9489 libs optional libssh_0.9.7-0+deb11u1_ppc64el-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEG6HwUrz8cgTg6xaPZnETzaamDSwFAmRqaL4ACgkQZnETzaam DSxWXw//d6WR1exAlGVdbCjcPc2idfDeddXY46w7mIUk3nIVbmf7R74jDAbeaRwN ziRBfoChD2m1HJU4VrwVkfmhfv2m+7unktSf5jGWDyxSmqJdQdz/Ev1bRVztWVUh AYtEDykfokm7CJl/gx0K+2UByJvkkFNJHJoPPyVBogz+t1BJm75P5wxZd3q6jrmN X8kzYESxpdeifJs7DognqeZQGdX+znShErq31FbfJbzgDyBHRYeO+ZXSXDzgz1Mk l9d71RZKaaoNwIid4GCvtzxWew4FG5Tq9VUWV4J6peZi8/bDpTwSnVaohHKbvx0I SjMe3p3kaDVNpNyKmgS/7hVwWnFxGVg6dMswddJW7MtHhfMesPoPnrooZddfHQ54 qt2IcJLB5qu7LMS5AQSHtrPTF/UIAMNEUvaHK5Xwkg69x71SH51jibIBGlvsm139 E5aGfVXzAlSwS3us4GPP+5n7ZCS/gAIqd3NuXlUq15w/DDRrXgmS/OtIndrhV6FW i1/9LCjv/KnzH9zRM9J77Y1Ducea+GXTPqYrr834tUz+FsJ1oa0gpQDoPsLSNREB 6mn2qJtFTXB+K71tO7fUh4r8UmOA0hnRDVykq7Dhtt2XNv2UUWuvlwodq5j3TvAr iQ5gvLykW2AshQxJ5qCPweG1m5EyWSdMM1Sg5GO4hp9k5Sh+r4g= =JQTG -----END PGP SIGNATURE-----