From nobody Tue Jul 2 16:11:37 2024
X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4WD7Fk0Bxrz5MtnX;
Tue, 02 Jul 2024 16:11:38 +0000 (UTC)
(envelope-from git@FreeBSD.org)
Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
client-signature RSA-PSS (4096 bits) client-digest SHA256)
(Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK))
by mx1.freebsd.org (Postfix) with ESMTPS id 4WD7Fj6qY2z49Mk;
Tue, 2 Jul 2024 16:11:37 +0000 (UTC)
(envelope-from git@FreeBSD.org)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim;
t=1719936698;
h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:mime-version:mime-version:content-type:content-type:
content-transfer-encoding:content-transfer-encoding;
bh=GMAiqMC4vPQfWDM230Yms0MCUg451UVVL6qKJecOomA=;
b=UKEEqaiRW8GHrkxXg37a5Q2KnsWkDD4AovjA+b5nb/r8NfbqpEv/V9KaNZxUHUMyO2QsNu
4xzkL76hOULXp9fXAs42Zlyd8Fear0A/cuaDqRrLr2RCMCZEtkFgCwcVIK+tiXddA6Qy0A
4LMYPbWnOScEprq3LEfY/88YN0orD4ASx10pJyULwbBbnyhDxO6u/4xFSV3/C+nrTf/XWR
CdYzHVueRQgTkWH2LQzrtEtCtZVJ2CDl16d9zBxHYWNL4AoylwykEWVPiQfvDfovBzhmdY
cAqNb4ynhoCxBl3O16I8GBd5jglAt+EVJJw8d4RSRMC9+1eaRoAc2LlkARbtWQ==
ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1719936698; a=rsa-sha256; cv=none;
b=l0VntjxrAsJ64p3torix55AcWvRamOrA8OTGaJDHN2sSeQtx94ZTlsQMxa7PUNhguQNJgk
Fn7BzR0n6i7VC5ACevGKvq7hwIFWolF8k1CQLsuW74pEHSGmMzCxpXm85n7HPH6JASZTfm
weDl/TO9S3MwMf/AmOkPz7X1nx8j+FRylKNYE5lzOaPrckKjNImM+wtcZuV5KN1yKj/cJU
wInXpFwpiR5juypwkpRY7iiTJqRxhih+jV/iP/1io+kZp3cS0NRnTDnGpoHNlsxg5qvvS+
KhZA/Otm72hlTy8+jBSLur0D5EE+7WaOZ06WHe7YZEDynRcKaFwp3aIoGjNRyg==
ARC-Authentication-Results: i=1;
mx1.freebsd.org;
none
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org;
s=dkim; t=1719936698;
h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:mime-version:mime-version:content-type:content-type:
content-transfer-encoding:content-transfer-encoding;
bh=GMAiqMC4vPQfWDM230Yms0MCUg451UVVL6qKJecOomA=;
b=D0QiCJed3r9mXewCzsPTbJmKOqVeA0lc3m4fvV3z9XJuMOgBvz3HIpq9KdTbD3TbWBxVVP
lBOms8mxnYH52k0cdMbS9QAFUIKpj5p8G+CFDrAFWne41fqc9mj4M5hiF19ueLh14QC3Hw
Ay5wb8oiZZkCtYHXwwvqPuQad1qdo9OJURGqErxiha83+HZQzWfLa0BHgc4W+TsJzjmg3a
dTq7tI+jHXGEU1M8SS+uz8+j+rUdxBAC23CGta0WRdLc+L17pjnRjVkQzUnm/Rqeqk7u3k
KPrvXDw0TiseqlprjCuXq3KD31ye6N3II9YBWAeL/phskacU30pR/HMvnv8LBg==
Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
(Client did not present a certificate)
by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4WD7Fj6RF4ztyT;
Tue, 2 Jul 2024 16:11:37 +0000 (UTC)
(envelope-from git@FreeBSD.org)
Received: from gitrepo.freebsd.org ([127.0.1.44])
by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 462GBbxF008721;
Tue, 2 Jul 2024 16:11:37 GMT
(envelope-from git@gitrepo.freebsd.org)
Received: (from git@localhost)
by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 462GBbJH008718;
Tue, 2 Jul 2024 16:11:37 GMT
(envelope-from git)
Date: Tue, 2 Jul 2024 16:11:37 GMT
Message-Id: <202407021611.462GBbJH008718@gitrepo.freebsd.org>
To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org,
dev-commits-ports-branches@FreeBSD.org
From: Bryan Drewery <bdrewery@FreeBSD.org>
Subject: git: 82c70bd1c2db - 2024Q2 - security/openssh-portable:
Bring in patches for recent CVES
List-Id: Commit messages for all branches of the ports repository <dev-commits-ports-all.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all
List-Help: <mailto:dev-commits-ports-all+help@freebsd.org>
List-Post: <mailto:dev-commits-ports-all@freebsd.org>
List-Subscribe: <mailto:dev-commits-ports-all+subscribe@freebsd.org>
List-Unsubscribe: <mailto:dev-commits-ports-all+unsubscribe@freebsd.org>
X-BeenThere: dev-commits-ports-all@freebsd.org
Sender: owner-dev-commits-ports-all@FreeBSD.org
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-Git-Committer: bdrewery
X-Git-Repository: ports
X-Git-Refname: refs/heads/2024Q2
X-Git-Reftype: branch
X-Git-Commit: 82c70bd1c2dbe11711390d24b0666cb31f5c4222
Auto-Submitted: auto-generated
The branch 2024Q2 has been updated by bdrewery:
URL: https://cgit.FreeBSD.org/ports/commit/?id=82c70bd1c2dbe11711390d24b0666cb31f5c4222
commit 82c70bd1c2dbe11711390d24b0666cb31f5c4222
Author: Bryan Drewery <bdrewery@FreeBSD.org>
AuthorDate: 2024-07-02 16:08:13 +0000
Commit: Bryan Drewery <bdrewery@FreeBSD.org>
CommitDate: 2024-07-02 16:10:56 +0000
security/openssh-portable: Bring in patches for recent CVES
Source: https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html
PR: 280068
(cherry picked from commit 7b31ce1eeeb40098b213a153e10530a196b52322)
---
security/openssh-portable/Makefile | 2 +-
security/openssh-portable/files/patch-9.8-cves | 56 ++++++++++++++++++++++++++
2 files changed, 57 insertions(+), 1 deletion(-)
diff --git a/security/openssh-portable/Makefile b/security/openssh-portable/Makefile
index ccf46bb23850..9b1d44580f94 100644
--- a/security/openssh-portable/Makefile
+++ b/security/openssh-portable/Makefile
@@ -1,6 +1,6 @@
PORTNAME= openssh
DISTVERSION= 9.7p1
-PORTREVISION= 0
+PORTREVISION= 2
PORTEPOCH= 1
CATEGORIES= security
MASTER_SITES= OPENBSD/OpenSSH/portable
diff --git a/security/openssh-portable/files/patch-9.8-cves b/security/openssh-portable/files/patch-9.8-cves
new file mode 100644
index 000000000000..2e47d586edcd
--- /dev/null
+++ b/security/openssh-portable/files/patch-9.8-cves
@@ -0,0 +1,56 @@
+https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html
+
+Damien Miller djm at mindrot.org
+Mon Jul 1 18:21:11 AEST 2024
+Previous message (by thread): Announce: OpenSSH 9.8 released
+Next message (by thread): Announce: OpenSSH 9.8 released
+Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
+Hi,
+
+Regarding the race condition fixed in OpenSSH 9.8. A mitigation to
+prevent exploitation of this bug is to disable the login grace timer
+by setting LoginGraceTime=0 in sshd_config. This will however make
+it much easier for an attacker to deny service to sshd.
+
+Similarly, the much more minor keystroke timing bug can be avoided
+by disabling the feature using ObscureKeystrokeTiming=0.
+
+Some users will understandably prefer to patch their OpenSSH rather
+than upgrade to the newest version, so here are minimal patches for
+both problems.
+
+1) Critical race condition in sshd
+
+2) Minor logic error in ObscureKeystrokeTiming
+
+--- log.c.orig 2024-07-02 09:05:35.023051000 -0700
++++ log.c 2024-07-02 09:05:54.881067000 -0700
+@@ -451,12 +451,14 @@ sshsigdie(const char *file, const char *func, int line
+ sshsigdie(const char *file, const char *func, int line, int showfunc,
+ LogLevel level, const char *suffix, const char *fmt, ...)
+ {
++#ifdef SYSLOG_R_SAFE_IN_SIGHAND
+ va_list args;
+
+ va_start(args, fmt);
+ sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL,
+ suffix, fmt, args);
+ va_end(args);
++#endif
+ _exit(1);
+ }
+
+--- clientloop.c.orig 2024-07-02 09:06:09.736347000 -0700
++++ clientloop.c 2024-07-02 09:06:41.414979000 -0700
+@@ -608,8 +608,9 @@ obfuscate_keystroke_timing(struct ssh *ssh, struct tim
+ if (timespeccmp(&now, &chaff_until, >=)) {
+ /* Stop if there have been no keystrokes for a while */
+ stop_reason = "chaff time expired";
+- } else if (timespeccmp(&now, &next_interval, >=)) {
+- /* Otherwise if we were due to send, then send chaff */
++ } else if (timespeccmp(&now, &next_interval, >=) &&
++ !ssh_packet_have_data_to_write(ssh)) {
++ /* If due to send but have no data, then send chaff */
+ if (send_chaff(ssh))
+ nchaff++;
+ }