diff options
author | Colin Watson <cjwatson@debian.org> | 2016-10-24 11:13:30 +0100 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2016-10-24 11:14:03 +0100 |
commit | 5dfa38163e4a5f0ae204fb61e520ce8bedbe629f (patch) | |
tree | 399ea6ce43d72a44d76d668e4302da93ccb0e4a1 /debian/patches/unregister-kexinit.patch | |
parent | 87ffbd30492802e44259cdfc0d8187393cc63917 (diff) | |
parent | b139635512b1af75e82252c0c71ac66e08b78774 (diff) |
CVE-2016-8858: Unregister the KEXINIT handler after message has been received (closes: #841884).
Diffstat (limited to 'debian/patches/unregister-kexinit.patch')
-rw-r--r-- | debian/patches/unregister-kexinit.patch | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/debian/patches/unregister-kexinit.patch b/debian/patches/unregister-kexinit.patch new file mode 100644 index 000000000..48da43273 --- /dev/null +++ b/debian/patches/unregister-kexinit.patch | |||
@@ -0,0 +1,34 @@ | |||
1 | From b139635512b1af75e82252c0c71ac66e08b78774 Mon Sep 17 00:00:00 2001 | ||
2 | From: "markus@openbsd.org" <markus@openbsd.org> | ||
3 | Date: Mon, 10 Oct 2016 19:28:48 +0000 | ||
4 | Subject: upstream commit | ||
5 | |||
6 | Unregister the KEXINIT handler after message has been | ||
7 | received. Otherwise an unauthenticated peer can repeat the KEXINIT and cause | ||
8 | allocation of up to 128MB -- until the connection is closed. Reported by | ||
9 | shilei-c at 360.cn | ||
10 | |||
11 | Upstream-ID: 43649ae12a27ef94290db16d1a98294588b75c05 | ||
12 | |||
13 | Origin: https://anongit.mindrot.org/openssh.git/commit/?id=ec165c392ca54317dbe3064a8c200de6531e89ad | ||
14 | Bug-Debian: https://bugs.debian.org/841884 | ||
15 | Bug-Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1384860 | ||
16 | Last-Update: 2016-10-24 | ||
17 | |||
18 | Patch-Name: unregister-kexinit.patch | ||
19 | --- | ||
20 | kex.c | 1 + | ||
21 | 1 file changed, 1 insertion(+) | ||
22 | |||
23 | diff --git a/kex.c b/kex.c | ||
24 | index c17d652..7ab72ba 100644 | ||
25 | --- a/kex.c | ||
26 | +++ b/kex.c | ||
27 | @@ -488,6 +488,7 @@ kex_input_kexinit(int type, u_int32_t seq, void *ctxt) | ||
28 | if (kex == NULL) | ||
29 | return SSH_ERR_INVALID_ARGUMENT; | ||
30 | |||
31 | + ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL); | ||
32 | ptr = sshpkt_ptr(ssh, &dlen); | ||
33 | if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0) | ||
34 | return r; | ||