svn commit: r50656 - in head/share: security/advisories security/patches/EN-17:07 security/patches/EN-17:08 security/patches/SA-17:06 xml
Xin LI <[email protected]>
| Newsgroups | gmane.os.freebsd.devel.cvs.doc |
|---|---|
| Message-ID | <[email protected]> |
Author: delphij
Date: Thu Aug 10 07:14:48 2017
New Revision: 50656
URL: https://svnweb.freebsd.org/changeset/doc/50656
Log:
Add SA-17:06, EN-17:07 and EN-17:08.
Added:
head/share/security/advisories/FreeBSD-EN-17:07.vnet.asc (contents, props changed)
head/share/security/advisories/FreeBSD-EN-17:08.pf.asc (contents, props changed)
head/share/security/advisories/FreeBSD-SA-17:06.openssh.asc (contents, props changed)
head/share/security/patches/EN-17:07/
head/share/security/patches/EN-17:07/vnet.patch (contents, props changed)
head/share/security/patches/EN-17:07/vnet.patch.asc (contents, props changed)
head/share/security/patches/EN-17:08/
head/share/security/patches/EN-17:08/pf.patch (contents, props changed)
head/share/security/patches/EN-17:08/pf.patch.asc (contents, props changed)
head/share/security/patches/SA-17:06/
head/share/security/patches/SA-17:06/openssh.patch (contents, props changed)
head/share/security/patches/SA-17:06/openssh.patch.asc (contents, props changed)
Modified:
head/share/xml/advisories.xml
head/share/xml/notices.xml
Added: head/share/security/advisories/FreeBSD-EN-17:07.vnet.asc
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/share/security/advisories/FreeBSD-EN-17:07.vnet.asc Thu Aug 10 07:14:48 2017 (r50656)
@@ -0,0 +1,133 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-EN-17:07.vnet Errata Notice
+ The FreeBSD Project
+
+Topic: VNET kernel panic with asynchronous I/O
+
+Category: core
+Module: kernel
+Announced: 2017-08-10
+Credits: Kristof Provost
+Affects: FreeBSD 11.0 and later.
+Corrected: 2017-07-28 18:09:41 UTC (stable/11, 11.1-STABLE)
+ 2017-08-10 06:59:07 UTC (releng/11.1, 11.1-RELEASE-p1)
+ 2017-08-10 06:59:26 UTC (releng/11.0, 11.0-RELEASE-p12)
+
+For general information regarding FreeBSD Errata Notices and Security
+Advisories, including descriptions of the fields above, security
+branches, and the following sections, please visit
+<URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+POSIX asynchronous I/O permits applications to request asynchronous
+completion of I/O requests. VNET permits systems to be configured
+with multiple instances of the in-kernel network stack.
+
+II. Problem Description
+
+The implementation of POSIX asynchronous I/O for sockets completes I/O
+requests in a pool of dedicated worker threads. The VNET feature requires
+threads to explicitly select an active instance of the network stack before
+performing network operations. The function used to complete asynchronous
+I/O requests was not setting a network stack instance before completing I/O
+requests.
+
+III. Impact
+
+Using POSIX asynchronous I/O with sockets in a VNET-enabled kernel will
+panic.
+
+IV. Workaround
+
+No workaround is available, but systems that do not enable VNET via a
+custom kernel are not affected.
+
+V. Solution
+
+Perform one of the following:
+
+1) Upgrade your system to a supported FreeBSD stable or release / security
+branch (releng) dated after the correction date.
+
+Afterward, reboot the system.
+
+2) To update your system via a binary patch:
+
+Systems running a RELEASE version of FreeBSD on the i386 or amd64
+platforms can be updated via the freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+
+Recompile any custom kernel configs using VNET.
+
+Afterward, reboot the system.
+
+3) To update your system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/EN-17:07/vnet.patch
+# fetch https://security.FreeBSD.org/patches/EN-17:07/vnet.patch.asc
+# gpg --verify vnet.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch < /path/to/patch
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+The following list contains the correction revision numbers for each
+affected branch.
+
+Branch/path Revision
+- -------------------------------------------------------------------------
+stable/11/ r321657
+releng/11.0/ r322343
+releng/11.1/ r322342
+- -------------------------------------------------------------------------
+
+To see which files were modified by a particular revision, run the
+following command, replacing NNNNNN with the revision number, on a
+machine with Subversion installed:
+
+# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
+
+Or visit the following URL, replacing NNNNNN with the revision number:
+
+<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
+
+VII. References
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-17:07.vnet.asc>
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.1.21 (FreeBSD)
+
+iQIzBAEBCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAlmMBgEACgkQ7Wfs1l3P
+audTDg//WDiH3PoHyr5YmcG4tUwgPFgodV8zUDrURGoLI2DIUwX/RPdsOhHFRIJG
+K7ueneJWZDN2IGzNjzrzXAyz30emOhp2AjHwRivqsl0JJ3YWt2IWMge0+FI3RIzp
+56+/gmCuTCsCOUxHxuuvN7v14d7WBVLUfouKV09E6wNWcbwiy1i+hjEEFbjbBIcR
+XRJJ+iePreq4XWJAyBTRYme24NWk4MUdYZjdprfkGURDycKvlmVqTnafR7RIP9zw
+2duCA5iOen50qShxtNm9z5OSlH1ORCh7DIhFmrdiNGQnNNDbAWU1pglSEWUCYtyn
+8WrWLKKqfbfYhVveEWalnN4iLAuvgrlq6bTxQ8zecwtj/VYZd1zXABUpZpDOqUB5
+yrNY7A/5opwkBgkv33zG/Ll141UdgCEkWWZm+eFIuX21UIdJmScKoTtGUyC/jldw
+yS724uwVfpxRqHf84Th4iYOk1gegpA0vEnhO5Eh8ZSfONXhydQxNQM3D1wI7MkA2
+rKH+UBucOnczPmSFT/GgO9B3iyXQl8nQR/Ff6VdmBEu56vW1sb0a1HYMOWZUfJxK
++SyZ4mMAtyrceHV1I1Z5Lqk3g8rKnS6l6/QzRCIanXZPMx2oohsSFik06taIYE62
+CbuUO6RcXZdTEk6nBFGhuFVew6xjvHXgEIpZ6g3tjrZ/Qqspt/0=
+=XzXx
+-----END PGP SIGNATURE-----
Added: head/share/security/advisories/FreeBSD-EN-17:08.pf.asc
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/share/security/advisories/FreeBSD-EN-17:08.pf.asc Thu Aug 10 07:14:48 2017 (r50656)
@@ -0,0 +1,127 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-EN-17:08.pf Errata Notice
+ The FreeBSD Project
+
+Topic: pf(4) housekeeping thread causes kernel panic
+
+Category: core
+Module: pf
+Announced: 2017-08-10
+Credits: Kristof Provost, Vinícius Zavam, Paul Herman
+Affects: FreeBSD 11.x
+Corrected: 2017-07-20 17:15:18 UTC (stable/11, 11.1-STABLE)
+ 2017-08-10 06:59:07 UTC (releng/11.1, 11.1-RELEASE-p1)
+
+For general information regarding FreeBSD Errata Notices and Security
+Advisories, including descriptions of the fields above, security
+branches, and the following sections, please visit
+<URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+pf(4) is one of several packet filter available in FreeBSD, originally
+written for OpenBSD. In addition to filtering packets, it also has packet
+normalization capabilities.
+
+II. Problem Description
+
+A pf housekeeping thread (pf_purge_thread) could potentially use an
+uninitialized variable, leading to a division by zero and a kernel panic.
+
+III. Impact
+
+Affected systems panic during startup.
+
+IV. Workaround
+
+No workaround is available, but systems not loading the pf kernel module are
+not affected. Once a system has started successfully it will not be at risk
+of this problem until it is restarted.
+
+V. Solution
+
+Perform one of the following:
+
+1) Upgrade your system to a supported FreeBSD stable or release / security
+branch (releng) dated after the correction date.
+
+Afterward, reboot the system.
+
+2) To update your system via a binary patch:
+
+Systems running a RELEASE version of FreeBSD on the i386 or amd64
+platforms can be updated via the freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+
+Afterward, reboot the system.
+
+3) To update your system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/EN-17:08/pf.patch
+# fetch https://security.FreeBSD.org/patches/EN-17:08/pf.patch.asc
+# gpg --verify pf.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch < /path/to/patch
+
+c) Recompile your kernel as described in
+<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
+system.
+
+VI. Correction details
+
+The following list contains the correction revision numbers for each
+affected branch.
+
+Branch/path Revision
+- -------------------------------------------------------------------------
+stable/11/ r321296
+releng/11.1/ r322342
+- -------------------------------------------------------------------------
+
+To see which files were modified by a particular revision, run the
+following command, replacing NNNNNN with the revision number, on a
+machine with Subversion installed:
+
+# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
+
+Or visit the following URL, replacing NNNNNN with the revision number:
+
+<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
+
+VII. References
+
+<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=220830>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-17:08.pf.asc>
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.1.21 (FreeBSD)
+
+iQIzBAEBCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAlmMBgEACgkQ7Wfs1l3P
+aufndRAA3TYyp6qZzZ+m9Tp5pvDVLPwizN/k/6EkazC2nz1H9vlqG5l6Ho/N+QJ1
+6rDfRw/K/+ijOoy0C/3WfUFeiu38DUnsbxE4LrBb+HterEOdLU1hZmmI5hTZqsoE
+8wyV4kcEpapUn1cgb0FWKBaujTYhGc/+z62p3IrPC1mN+P8B5mkzTryYfXvaxA4E
+3xBW/abjRIOh3bxQ9BPqGJBX/6Y+sle5XoHDDIvkmfzZU8sYjLFGXgeuxIfsh61h
+iBl1q4Tq35EDCK6cOr0s+ksg3q2mTrFNQF2Be4jMX47n1M3d+VeqZpgoa7jqrVY5
+Kv3nrhOaz4Wc/OdN1uxQW5Wxm2BS1/470/ghuOY4wVy59k/4n+esenzJyIeuG4vg
+GUBa1ZPrsf9fR3PQgr9E047dPdc8WU7UEwHZfXuXjU6ywGd95siHVY4XB9aPYYYk
+ZtzIHAuyOa8GANXjVvEsghSJ9nMleIGO7Tzn9zJ9W/gSxkMDy9EAP3Gaez9OVJko
+zGq2TwhnSMdZjmnBpCuF9uZqyeAqDtyj77RYzV8RmhmT1e6dt+EU7Wf4KU3/3Zcr
+mWq3wjBvbUJjDy2q9kpnGwnPmTDpXFFIXirgcxdj0QmyejVCRhM44d3UwFZQbxfj
+5vL2WwnpytB2+RiNDjhpWVc1FAldM7B+M+vhwsFHcbKKT5S9ciA=
+=cBQm
+-----END PGP SIGNATURE-----
Added: head/share/security/advisories/FreeBSD-SA-17:06.openssh.asc
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/share/security/advisories/FreeBSD-SA-17:06.openssh.asc Thu Aug 10 07:14:48 2017 (r50656)
@@ -0,0 +1,137 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+=============================================================================
+FreeBSD-SA-17:06.openssh Security Advisory
+ The FreeBSD Project
+
+Topic: OpenSSH Denial of Service vulnerability
+
+Category: contrib
+Module: OpenSSH
+Announced: 2017-08-10
+Affects: All supported versions of FreeBSD.
+Corrected: 2017-08-10 06:36:37 UTC (stable/11, 11.1-STABLE)
+ 2017-08-10 06:59:07 UTC (releng/11.1, 11.1-RELEASE-p1)
+ 2017-08-10 06:59:26 UTC (releng/11.0, 11.0-RELEASE-p12)
+ 2017-08-10 06:36:37 UTC (stable/10, 10.3-STABLE)
+ 2017-08-10 06:59:43 UTC (releng/10.3, 10.3-RELEASE-p21)
+CVE Name: CVE-2016-6515
+
+For general information regarding FreeBSD Security Advisories,
+including descriptions of the fields above, security branches, and the
+following sections, please visit <URL:https://security.FreeBSD.org/>.
+
+I. Background
+
+OpenSSH is an implementation of the SSH protocol suite, providing an
+encrypted and authenticated transport for a variety of services,
+including remote shell access.
+
+OpenSSH supports a built-in password authentication method, which is
+enabled with PasswordAuthentication. This option is disabled by
+default on FreeBSD.
+
+II. Problem Description
+
+There is no limit on the password length.
+
+III. Impact
+
+A remote attacker may be able to cause an affected SSH server to use
+excessive amount of CPU by sending very long passwords, when
+PasswordAuthentication is enabled by the system administrator.
+
+IV. Workaround
+
+Disable PasswordAuthentication in /etc/ssh/sshd_config and restart
+sshd. This is the default FreeBSD configuration.
+
+V. Solution
+
+Perform one of the following:
+
+1) Upgrade your vulnerable system to a supported FreeBSD stable or
+release / security branch (releng) dated after the correction date.
+
+Restart SSH service.
+
+2) To update your vulnerable system via a binary patch:
+
+Systems running a RELEASE version of FreeBSD on the i386 or amd64
+platforms can be updated via the freebsd-update(8) utility:
+
+# freebsd-update fetch
+# freebsd-update install
+
+Restart SSH service.
+
+3) To update your vulnerable system via a source code patch:
+
+The following patches have been verified to apply to the applicable
+FreeBSD release branches.
+
+a) Download the relevant patch from the location below, and verify the
+detached PGP signature using your PGP utility.
+
+# fetch https://security.FreeBSD.org/patches/SA-17:06/openssh.patch
+# fetch https://security.FreeBSD.org/patches/SA-17:06/openssh.patch.asc
+# gpg --verify openssh.patch.asc
+
+b) Apply the patch. Execute the following commands as root:
+
+# cd /usr/src
+# patch < /path/to/patch
+
+c) Recompile the operating system using buildworld and installworld as
+described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
+
+Restart the SSH daemon, or reboot the system.
+
+VI. Correction details
+
+The following list contains the correction revision numbers for each
+affected branch.
+
+Branch/path Revision
+- -------------------------------------------------------------------------
+stable/10/ r322341
+releng/10.3/ r322344
+stable/11/ r322341
+releng/11.0/ r322343
+releng/11.1/ r322342
+- -------------------------------------------------------------------------
+
+To see which files were modified by a particular revision, run the
+following command, replacing NNNNNN with the revision number, on a
+machine with Subversion installed:
+
+# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
+
+Or visit the following URL, replacing NNNNNN with the revision number:
+
+<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
+
+VII. References
+
+<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6515>
+
+The latest revision of this advisory is available at
+<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-17:06.openssh.asc>
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.1.21 (FreeBSD)
+
+iQIzBAEBCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAlmMBgIACgkQ7Wfs1l3P
+aucJdxAA08okYfV547zvlAnX0t2lzVY7k0EDpXJChmmOjTwcvWODXMCyfTzP0EQb
+E7QjGushlfGU8tgCrbcFf46r2NgDRlqf5/+QK/fIohcQNwfKwJV0J5oeICzTwwOY
+rAjgeg03T785nSiF/WyX3NsdWv/uVvJqalAqfohj4O1YUEkZPezDUdcys+ESvqAW
+ujEQId1sD3wlHcwZweFmN60hzHuqR2o6+/3G8aT9ZZG3v46nM6moZiUyF5vh1hEl
+16y86kyAIrTb0cCpsUL3M6ajQ15y/EQEzQBCqMedGdWlJzOFZyxgsCikcCw+07pr
+u0NCrzq37E+8hQGFQk5ZoZxQb/8xaReQACi+RZeJAevWX0vOni6dCSWPMy6WqXOf
+D8CzEcZiT+fYB4/zev/xPxlF5onEw4gbTkgbu1KLvBD9AgSKu7MdPoxkpyOwolMs
+nAC084kl+yYJuxHAr7W58VdGPFDOHsvG6YYWQ4nwKjJqKGi24eOGQkOPUtBuJRYA
+Q8ISdE0VXiMmND0vhLNDh0Gjbupz3nBNoawGAGy9OsNqRhQ6ioYIte67Ku+ev7nz
+ydS8P72ExWuYQHsyVIoJviAAFnSPA2H15/tCES5Di8SkeLik7tQrI3SHOH0qd328
+dl0l2VGnnWYsAgGa68Xksn/DZd07cdpp5q1GitqvMPeDBb8/Iaw=
+=FxJQ
+-----END PGP SIGNATURE-----
Added: head/share/security/patches/EN-17:07/vnet.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/share/security/patches/EN-17:07/vnet.patch Thu Aug 10 07:14:48 2017 (r50656)
@@ -0,0 +1,18 @@
+--- sys/kern/sys_socket.c.orig
++++ sys/kern/sys_socket.c
+@@ -675,6 +675,7 @@
+ {
+ struct kaiocb *job;
+
++ CURVNET_SET(so->so_vnet);
+ SOCKBUF_LOCK(sb);
+ while (!TAILQ_EMPTY(&sb->sb_aiojobq) && soaio_ready(so, sb)) {
+ job = TAILQ_FIRST(&sb->sb_aiojobq);
+@@ -698,6 +699,7 @@
+ ACCEPT_LOCK();
+ SOCK_LOCK(so);
+ sorele(so);
++ CURVNET_RESTORE();
+ }
+
+ void
Added: head/share/security/patches/EN-17:07/vnet.patch.asc
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/share/security/patches/EN-17:07/vnet.patch.asc Thu Aug 10 07:14:48 2017 (r50656)
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.1.21 (FreeBSD)
+
+iQIzBAABCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAlmMBigACgkQ7Wfs1l3P
+aud1/g//T+r0QjiYhomNf6Nuqc1mQKRG7YT0rJJ7bBHNn+ftOFuscW8gzgfvkL8m
+I8jJVEnWyQy6+tcsg0aZt0WntmAyM+tmmdXZA55WdeZ550jzfKyJRCjya7vTGqWT
+3ewoXm5Vsw08+Cr5CgF1YZWHHDXGXSScoiOsWnjqXHywRg2t4lrJjEWJOh/BZq+q
+ro0pL236Awa7R2OnystMF8Vp7XUPjKcueEDmrjqmq9vMqvXJn1D/XW/p8StTDdRB
+E00IYcuyZEX2s1OrEEqusHsRjNMPIJCb1x0eJl6Zh/lekjejl5hG7VhlJJicl9GN
+kzATbcIcifEAZEwSPx1THgZwJL1PzQJ7peyALCG/hB6buqYonYP7JrWNcQq32vg+
+P1BlLq8XfUa2yV7H8x2fUBcUN7Xjy7/8d/nJd68gX2vdDjOfvh43xAnECUDnWpGW
+AzRLFiMJJ5blv1fjn3xDLBoEPOMY7uwIk0I7ye9FUAIQRdD1jvTimcTI0wx0i0lE
+6HHjNtpC7ZYhk7ADFouzCfzAUYfzPY0xFP/Qp9vmR+DiFQffAAUn4vhHpiROoEHd
+k+PK+0wihcnglHj+v/A0vFYgJ86cWqF7tDA2iwkqVhXJWwWkQ+ZTiYJBaFRqNPWw
+k8lMNOcs0BxLZ4XRKqH/wr/r9ZsDtAVDiz0G8ANo1+FdXbVqAcI=
+=QQJA
+-----END PGP SIGNATURE-----
Added: head/share/security/patches/EN-17:08/pf.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/share/security/patches/EN-17:08/pf.patch Thu Aug 10 07:14:48 2017 (r50656)
@@ -0,0 +1,24 @@
+--- sys/netpfil/pf/pf.c.orig
++++ sys/netpfil/pf/pf.c
+@@ -129,6 +129,8 @@
+ #define V_pf_tcp_secret_init VNET(pf_tcp_secret_init)
+ VNET_DEFINE(int, pf_tcp_iss_off);
+ #define V_pf_tcp_iss_off VNET(pf_tcp_iss_off)
++VNET_DECLARE(int, pf_vnet_active);
++#define V_pf_vnet_active VNET(pf_vnet_active)
+
+ /*
+ * Queue for pf_intr() sends.
+@@ -1441,6 +1443,12 @@
+ kproc_exit(0);
+ }
+
++ /* Wait while V_pf_default_rule.timeout is initialized. */
++ if (V_pf_vnet_active == 0) {
++ CURVNET_RESTORE();
++ continue;
++ }
++
+ /* Process 1/interval fraction of the state table every run. */
+ idx = pf_purge_expired_states(idx, pf_hashmask /
+ (V_pf_default_rule.timeout[PFTM_INTERVAL] * 10));
Added: head/share/security/patches/EN-17:08/pf.patch.asc
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/share/security/patches/EN-17:08/pf.patch.asc Thu Aug 10 07:14:48 2017 (r50656)
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.1.21 (FreeBSD)
+
+iQIzBAABCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAlmMBigACgkQ7Wfs1l3P
+auf3yhAA3kHXPGMKXhLNNU4x4Nen4lwOPw78L+ZIboLMCT8cOLRDXtHiqLdGljeQ
+jQfNTXxL3wgNYyX8M3uwbvTeuJ1XGqWoDvdqCB/ngfUNQjnaturyKBiu60soiXJp
+RIta99QQ+PUpL6e5Kxnb9jIF0HvFELkxfq6eicS2d7V/QjcZAKpArF14vOAVdt18
+C+aUY5wpNFzvyDJ6a/uWpexACnS2wFMElWOV10fjh4vSMaxCectK6eejT7ansQC2
+OAcpyzd6p2giidw2D+B54PGZAOX2utKEpJ9jBm+ITFYqhasQm3WtEQ0ozl8Rc4Ru
+j4DToZwFwwaKTcpyKE2C3E9EtqiadePkQoFkfhQixdcUm7FFj0k+6Kou3QT4eAMy
+5iuenPh9q2oMrW0ye8EqTVyRan9s4+jBpiibW/AEIPguegGl9L2Pg3Xw39pTXLPj
+D0+la6GnESFWRod9w6IPcL97EQuD2NnBRkMru2xHHk7636Zc9aE12oI0ckrhfi7D
+Pda31jKEC3BucLMIGMnVU8JN7IX3abbY+wgL8ttWeGmjr4TRMnV8fX0b/4bhKOx5
+fQMakqxQXBJr8i9tPmx43+TPO8f9ddqtSDKRAfZTpASN0ugCFyH08veTx8Ahh7bQ
+TwyY8wRFQCxEeod1kJ4rUoWou1/1tMZiM4N3+I2Os7E+HdO+3HY=
+=hezW
+-----END PGP SIGNATURE-----
Added: head/share/security/patches/SA-17:06/openssh.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/share/security/patches/SA-17:06/openssh.patch Thu Aug 10 07:14:48 2017 (r50656)
@@ -0,0 +1,21 @@
+--- crypto/openssh/auth-passwd.c.orig
++++ crypto/openssh/auth-passwd.c
+@@ -66,6 +66,8 @@
+ #define DAY (24L * 60 * 60) /* 1 day in seconds */
+ #define TWO_WEEKS (2L * 7 * DAY) /* 2 weeks in seconds */
+
++#define MAX_PASSWORD_LEN 1024
++
+ void
+ disable_forwarding(void)
+ {
+@@ -87,6 +89,9 @@
+ static int expire_checked = 0;
+ #endif
+
++ if (strlen(password) > MAX_PASSWORD_LEN)
++ return 0;
++
+ #ifndef HAVE_CYGWIN
+ if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
+ ok = 0;
Added: head/share/security/patches/SA-17:06/openssh.patch.asc
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/share/security/patches/SA-17:06/openssh.patch.asc Thu Aug 10 07:14:48 2017 (r50656)
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.1.21 (FreeBSD)
+
+iQIzBAABCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAlmMBicACgkQ7Wfs1l3P
+aueQ2hAAlv9j3RiWL+SaafCb4DUcDEq99zGpHbOAr1wgV/n7UqFpaan5UIE9z92e
+YJXKJrwvxMr4Znc9O0MI6C/fawIgO1g/699Q9CwlmROtqBaF2Qz7PTj7RP5IntOZ
+RgFNycPvq8qy+H1S1yK8UbfQ+3rl2Vz1xBe9SwmXvseHhVIHxr2l8mLTjEPtInOW
+EMXsdX+QPX3+4uPX+mkV4WtPt4YYmM3aHVeqI2YVwe6DlsWL4y2OIBz23B9Lggwp
+28m4sIfonNtZwDf0BSf7sdzPzYGQyjQ9Kwr5SEyqOV0eR9FeHr6cjW4UBu3X1X0I
+eeCTBcrHbzcpEFr75pvEbsTRhzGVtBWtTAhvD+eXN2NaqTQrivvFAZaYiu8tWlpZ
+QYgMwdwotZd96msiI1H1M6IdM1wJjEvXlaipnoAKkX2b88Hd5WDA2q2PZSU5BMDP
+gKK51xc6BQ/6KzwCyfxNX0vzImM7mL6MBo7y9Lqi/7U3CPQmuDX3sCzs6fLp0kli
+fQLpjetc5IcIFhyRnvRUpDVvfnU8KyyveU4ZMJ1dqfAZnBGXtu+ri7hknVLO10HY
+XipKtvPkaMIA7v5ky/pTOyfRc0sqWUvHav0M7eDL331GaWoz9bUP5NcD+YowRAgs
+P4/LyAdTxkT53jzqGSf/RN3I8KRhniUzZVjTv6nq39Qf6MvJG9g=
+=n0X7
+-----END PGP SIGNATURE-----
Modified: head/share/xml/advisories.xml
==============================================================================
--- head/share/xml/advisories.xml Wed Aug 9 15:40:15 2017 (r50655)
+++ head/share/xml/advisories.xml Thu Aug 10 07:14:48 2017 (r50656)
@@ -8,6 +8,18 @@
<name>2017</name>
<month>
+ <name>8</name>
+
+ <day>
+ <name>10</name>
+
+ <advisory>
+ <name>FreeBSD-SA-17:06.openssh</name>
+ </advisory>
+ </day>
+ </month>
+
+ <month>
<name>7</name>
<day>
Modified: head/share/xml/notices.xml
==============================================================================
--- head/share/xml/notices.xml Wed Aug 9 15:40:15 2017 (r50655)
+++ head/share/xml/notices.xml Thu Aug 10 07:14:48 2017 (r50656)
@@ -8,6 +8,22 @@
<name>2017</name>
<month>
+ <name>8</name>
+
+ <day>
+ <name>10</name>
+
+ <notice>
+ <name>FreeBSD-EN-17:08.pf</name>
+ </notice>
+
+ <notice>
+ <name>FreeBSD-EN-17:07.vnet</name>
+ </notice>
+ </day>
+ </month>
+
+ <month>
<name>7</name>
<day>
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-doc-all
To unsubscribe, send any mail to "[email protected]"