8935 2016-01-15 18:47:25 +0000 OpenSSH client: CVE-2016-0777, CVE-2016-0778 and CVE-2016-1907 2016-02-12 13:41:00 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core 2.0.1 x86 Multiple VERIFIED FIXED High normal 2.0.2 1 akuster akuster bogdanx.a.voiculescu joshuagloe meta.mr.watcher meta.watcher alexandru.costinx.roman --- --- No (bug/feature does not impact docs) oldest_to_newest 57881 0 akuster 2016-01-15 18:47:25 +0000 CVE-2016-0777 OpenSSH: Client Information leak due to use of roaming connection feature CVE-2016-0778 OpenSSH: Client buffer-overflow when using roaming connections 57882 1 akuster 2016-01-15 18:50:26 +0000 Master package was updated to 7.1p2 http://cgit.openembedded.org/openembedded-core/commit/?id=b3b679d5be86f73d1a06c7230cb00872f0a407b5 Jethro is at version 7.1.p1 so cherry-picking this should be ok. Fido needs patches.. working on them. 57883 2 akuster 2016-01-15 18:53:25 +0000 new on logged this morning. Master is affect > SECURITY: Fix an out of-bound read access in the packet handling code. > Reported by Ben Hawkes > https://anongit.mindrot.org/openssh.git/commit/?id=2fecfd486bdba9f51b3a789277bb0733ca36e1c0 Use CVE-2016-1907. 57887 3 akuster 2016-01-15 19:48:13 +0000 unfortunate I am getting fetch errors. ERROR: Function failed: Fetcher failure for URL: 'ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.1p2.tar.gz'. Unable to fetch URL from any source. ERROR: Logfile of failure stored in: /yocto/OE/maint/poky/build/tmp/work/core2-64-poky-linux/openssh/7.1p2-r0/temp/log.do_fetch.5930 ERROR: Task 5 (/yocto/OE/maint/poky/meta/recipes-connectivity/openssh/openssh_7.1p2.bb, do_fetch) failed with exit code '1' the tarball does not exists on openbsd nor any of its mirrors. maybe too soon. 57893 4 akuster 2016-01-16 00:22:32 +0000 CVE-2016-1907: Master and Jethro patch sent http://patches.openembedded.org/patch/112553/ Jethro was just updated for CVE-2016-0777 and CVE-2016-0778 by package update. 57894 5 akuster 2016-01-16 00:41:18 +0000 shoot. need two more commits for 2016-1907... https://anongit.mindrot.org/openssh.git/commit/?id=f98a09cacff7baad8748c9aa217afd155a4d493f https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c 57895 6 akuster 2016-01-16 01:01:30 +0000 new master and Jethro patch series sent. http://patches.openembedded.org/patch/112555/ 58166 7 akuster 2016-01-24 23:23:24 +0000 fido updated for CVE-2016-077x http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?h=fido&id=9845a542a76156adb5aef6fd33ad5bc5777acf64 58950 8 alexandru.costinx.roman 2016-02-12 13:41:00 +0000 Verified.