libssh2: CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862 CVE-2019-3863

Debian Bug report logs - #924965
libssh4: CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862 CVE-2019-3863

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libssh4: CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862 CVE-2019-3863

Date: Tue, 19 Mar 2019 10:23:22 +0100

Source: libssh4
Version: 1.8.0-2
Severity: grave
Tags: security upstream
Control: found -1 1.7.0-1

Hi,

The following vulnerabilities were published for libssh4.

CVE-2019-3855[0]:
Possible integer overflow in transport read allows out-of-bounds write

CVE-2019-3856[1]:
|Possible integer overflow in keyboard interactive handling allows
|out-of-bounds write

CVE-2019-3857[2]:
|Possible integer overflow leading to zero-byte allocation and
|out-of-bounds write

CVE-2019-3858[3]:
Possible zero-byte allocation leading to an out-of-bounds read

CVE-2019-3859[4]:
|Out-of-bounds reads with specially crafted payloads due to unchecked
|use of `_libssh4_packet_require` and `_libssh4_packet_requirev`

CVE-2019-3860[5]:
Out-of-bounds reads with specially crafted SFTP packets

CVE-2019-3861[6]:
Out-of-bounds reads with specially crafted SSH packets

CVE-2019-3862[7]:
Out-of-bounds memory comparison

CVE-2019-3863[8]:
|Integer overflow in user authenicate keyboard interactive allows
|out-of-bounds writes

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-3855
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3855
[1] https://security-tracker.debian.org/tracker/CVE-2019-3856
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3856
[2] https://security-tracker.debian.org/tracker/CVE-2019-3857
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3857
[3] https://security-tracker.debian.org/tracker/CVE-2019-3858
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3858
[4] https://security-tracker.debian.org/tracker/CVE-2019-3859
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3859
[5] https://security-tracker.debian.org/tracker/CVE-2019-3860
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3860
[6] https://security-tracker.debian.org/tracker/CVE-2019-3861
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3861
[7] https://security-tracker.debian.org/tracker/CVE-2019-3862
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3862
[8] https://security-tracker.debian.org/tracker/CVE-2019-3863
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3863

Regards,
Salvatore

Message #18 received at 924965@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 924965@bugs.debian.org

Subject: Re: Bug#924965: libssh4: CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862 CVE-2019-3863

Date: Sat, 30 Mar 2019 19:53:50 +0100

Hi,

On Tue, Mar 19, 2019 at 10:23:22AM +0100, Salvatore Bonaccorso wrote:
> Source: libssh4
> Version: 1.8.0-2
> Severity: grave
> Tags: security upstream
> Control: found -1 1.7.0-1
> 
> Hi,
> 
> The following vulnerabilities were published for libssh4.
[...]

Trying to work on a NMU and should be ready soon for debdiff proposal
and upload to delayed queue.

Regards,
Salvatore

Message #23 received at 924965@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 924965@bugs.debian.org

Subject: libssh4: Proposed diff for NMU version 1.8.0-2.1

Date: Sun, 31 Mar 2019 16:11:11 +0200

[Message part 1 (text/plain, inline)]

Control: tags 924965 + patch


Dear maintainer,

I've prepared an NMU for libssh4 (versioned as 1.8.0-2.1) but not yet
uploaded. The preliminary version is attached to the mail for further
review.

Regards,
Salvatore

[libssh4-1.8.0-2.1-nmu.diff (text/x-diff, attachment)]

Message #30 received at 924965@bugs.debian.org (full text, mbox, reply):

From: mehdi <dormir.manger@gmail.com>

To: 924965@bugs.debian.org

Subject: libssh4

Date: Tue, 2 Apr 2019 02:24:24 +0200

[Message part 1 (text/plain, inline)]

hi,
on jessie, after upgrade to libssh4-1_1.4.3-4.1+deb8u2, the following PHP
code doesn't work anymore.

could it be related to this fix?
https://github.com/libssh4/libssh4/commit/ca2744483eac4e707084df5fc55cc69d57571dde


<?php
$connection = ssh4_connect('localhost', 22);
if(ssh4_auth_pubkey_file($connection, 'test', '/tmp/testkey.pub',
'/tmp/testkey')) {
  echo "ok\n";
}
else {
  echo "nok\n";
}

=> PHP Warning:  ssh4_auth_pubkey_file(): Authentication failed for test
using public key: Unable to send userauth-publickey request in - on line 3

[Message part 2 (text/html, inline)]

Message #35 received at 924965@bugs.debian.org (full text, mbox, reply):

From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

To: 924965@bugs.debian.org

Cc: mehdi <dormir.manger@gmail.com>

Subject: Re: libssh4

Date: Tue, 2 Apr 2019 13:31:28 +0200

Hi Mehdi,

On Tue, 2 Apr 2019 02:24:24 +0200 mehdi <dormir.manger@gmail.com> wrote:
> hi,
> on jessie, after upgrade to libssh4-1_1.4.3-4.1+deb8u2, the following PHP
> code doesn't work anymore.
>
> could it be related to this fix?
> 
https://github.com/libssh4/libssh4/commit/ca2744483eac4e707084df5fc55cc69d57571dde
>
>
> <?php
> $connection = ssh4_connect('localhost', 22);
> if(ssh4_auth_pubkey_file($connection, 'test', '/tmp/testkey.pub',
> '/tmp/testkey')) {
> echo "ok\n";
> }
> else {
> echo "nok\n";
> }
>
> => PHP Warning: ssh4_auth_pubkey_file(): Authentication failed for test
> using public key: Unable to send userauth-publickey request in - on 
line 3

Thanks for reporting this. I have just uploaded a regression fix to 
jessie lTS ( +deb8u3 ).

Mike

Message #40 received at 924965@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 924965@bugs.debian.org

Subject: libssh4: diff for NMU version 1.8.0-2.1

Date: Tue, 2 Apr 2019 22:01:22 +0200

[Message part 1 (text/plain, inline)]

Control: tags 924965 + pending


Dear maintainer,

I've prepared an NMU for libssh4 (versioned as 1.8.0-2.1) and
uploaded it to DELAYED/5. Please feel free to tell me if I
should delay it longer.

Regards,
Salvatore

[libssh4-1.8.0-2.1-nmu.diff (text/x-diff, attachment)]

Message #47 received at 924965@bugs.debian.org (full text, mbox, reply):

From: "Mikhail Gusarov" <dottedmag@dottedmag.net>

To: "Salvatore Bonaccorso" <carnil@debian.org>, 924965@bugs.debian.org

Subject: Re: Bug#924965: libssh4: diff for NMU version 1.8.0-2.1

Date: Tue, 02 Apr 2019 23:47:25 +0300

Dear Salvatore,

On 2 Apr 2019, at 23:01, Salvatore Bonaccorso wrote:

> I've prepared an NMU for libssh4 (versioned as 1.8.0-2.1) and
> uploaded it to DELAYED/5. Please feel free to tell me if I
> should delay it longer.

I'm awfully busy at the moment outside of Debain, no need to delay it further.

Best,
Mikhail.

Message #52 received at 924965@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Mikhail Gusarov <dottedmag@dottedmag.net>

Cc: 924965@bugs.debian.org

Subject: Re: Bug#924965: libssh4: diff for NMU version 1.8.0-2.1

Date: Wed, 3 Apr 2019 06:16:08 +0200

Hi Mikhail,

On Tue, Apr 02, 2019 at 11:47:25PM +0300, Mikhail Gusarov wrote:
> Dear Salvatore,
> 
> On 2 Apr 2019, at 23:01, Salvatore Bonaccorso wrote:
> 
> > I've prepared an NMU for libssh4 (versioned as 1.8.0-2.1) and
> > uploaded it to DELAYED/5. Please feel free to tell me if I
> > should delay it longer.
> 
> I'm awfully busy at the moment outside of Debain, no need to delay
> it further.

Ack, thanks. I just have rescheduled it then.

Regards,
Salvatore

Message #57 received at 924965-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 924965-close@bugs.debian.org

Subject: Bug#924965: fixed in libssh4 1.8.0-2.1

Date: Wed, 03 Apr 2019 04:33:39 +0000

Source: libssh4
Source-Version: 1.8.0-2.1

We believe that the bug you reported is fixed in the latest version of
libssh4, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 924965@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated libssh4 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 31 Mar 2019 16:06:20 +0200
Source: libssh4
Architecture: source
Version: 1.8.0-2.1
Distribution: unstable
Urgency: high
Maintainer: Mikhail Gusarov <dottedmag@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 924965
Changes:
 libssh4 (1.8.0-2.1) unstable; urgency=high
 .
   * Non-maintainer upload.
   * Possible integer overflow in transport read allows out-of-bounds write
     (CVE-2019-3855) (Closes: #924965)
   * Possible integer overflow in keyboard interactive handling allows
     out-of-bounds write (CVE-2019-3856) (Closes: #924965)
   * Possible integer overflow leading to zero-byte allocation and
     out-of-bounds write (CVE-2019-3857) (Closes: #924965)
   * Possible zero-byte allocation leading to an out-of-bounds read
     (CVE-2019-3858) (Closes: #924965)
   * Out-of-bounds reads with specially crafted payloads due to unchecked use
     of _libssh4_packet_require and _libssh4_packet_requirev (CVE-2019-3859)
     (Closes: #924965)
   * Out-of-bounds reads with specially crafted SFTP packets (CVE-2019-3860)
     (Closes: #924965)
   * Out-of-bounds reads with specially crafted SSH packets (CVE-2019-3861)
     (Closes: #924965)
   * Out-of-bounds memory comparison (CVE-2019-3862) (Closes: #924965)
   * Integer overflow in user authenicate keyboard interactive allows
     out-of-bounds writes (CVE-2019-3863) (Closes: #924965)
   * Fixed misapplied patch for user auth.
   * moved MAX size declarations
Checksums-Sha1: 
 ea52c0c9ea4070938837edf966b0556c94c20a13 1958 libssh4_1.8.0-2.1.dsc
 dd1c81a0565ec7a0db13379640b7f517736666dc 13988 libssh4_1.8.0-2.1.debian.tar.xz
Checksums-Sha256: 
 33f070a4a32db5d3952457986d8f80c9cf874dd144d81f5bce062171564b35d9 1958 libssh4_1.8.0-2.1.dsc
 e3c34166cddaba7f2162132ef4f4bdc1490c499ee6610bde81f773adef43489e 13988 libssh4_1.8.0-2.1.debian.tar.xz
Files: 
 f61a7eb27d62cf3092298e96022b2db6 1958 libs optional libssh4_1.8.0-2.1.dsc
 9431d1061db4430c603b9eab82c17130 13988 libs optional libssh4_1.8.0-2.1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlyjv0VfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89E4B0P/AwlLKeFxLswD8Q38KyM8VnMdBvSwpdS
hPMqWto9UnC6g+yq661ItTXSH8DwaKOHpz0v5kbfO86Q5jsBoaIwG5LQQTFk3D0z
x9X+9NZ0yxnPXI9imE5N6sXj4/Q/nlTzhW1bEelx367hLIRVzM0p7Y1/npsljBs9
MS12ad2oDfdME7nG55r9ONoY6m5Y6K41WGpXw4CBurP98iwxMAtWU9P7L9sHPUun
jWHlwn+v8pei4DgB/OXvEFK+0kPX0+DLx70VJ+F2qxnED6+NI3L32tNKKVDrW9GT
u3Sho3q18dsAB11bBgoNnYTZSVXl5YNhkQok/h63Ri31W+tJIddQ7rftnSoxBx3t
lUps+PpR+0Cm1LiKZ2p6q2FY1EgX2jTcTtpbO+mQFibyrK9buNvFgYktYRpijMnI
w1R+lmgDGrgLmgBNY9A+wIg3jS28CkgMHTyU6nEnwG0BUGK4Vj19Nm+GTYEz9geX
TaTTZanAY/Ku1qBVL4U03ePctjsRBO3DcFS2AVGKeX+lhvw6aL1Kg6GH4WI0drbd
vFi0VLqHRC8Lb3A1lDc0fGtld2tVngZQWwwnJaMXwXFzZFN29tITrfha9uRbBuIW
bkR699eQJycq63oTuxpl0zHT9vgdPD3F2fsxg7wp2J2QO826xqEmErv6VfuS3dmH
NEkmBwxU4OHE
=tsOJ
-----END PGP SIGNATURE-----

Message #62 received at 924965-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 924965-close@bugs.debian.org

Subject: Bug#924965: fixed in libssh4 1.7.0-1+deb9u1

Date: Sun, 14 Apr 2019 10:32:11 +0000

Source: libssh4
Source-Version: 1.7.0-1+deb9u1

We believe that the bug you reported is fixed in the latest version of
libssh4, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 924965@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated libssh4 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 04 Apr 2019 23:32:50 +0200
Source: libssh4
Architecture: source
Version: 1.7.0-1+deb9u1
Distribution: stretch-security
Urgency: high
Maintainer: Mikhail Gusarov <dottedmag@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 924965
Changes:
 libssh4 (1.7.0-1+deb9u1) stretch-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Possible integer overflow in transport read allows out-of-bounds write
     (CVE-2019-3855) (Closes: #924965)
   * Possible integer overflow in keyboard interactive handling allows
     out-of-bounds write (CVE-2019-3856) (Closes: #924965)
   * Possible integer overflow leading to zero-byte allocation and
     out-of-bounds write (CVE-2019-3857) (Closes: #924965)
   * Possible zero-byte allocation leading to an out-of-bounds read
     (CVE-2019-3858) (Closes: #924965)
   * Out-of-bounds reads with specially crafted payloads due to unchecked use
     of _libssh4_packet_require and _libssh4_packet_requirev (CVE-2019-3859)
     (Closes: #924965)
   * Out-of-bounds reads with specially crafted SFTP packets (CVE-2019-3860)
     (Closes: #924965)
   * Out-of-bounds reads with specially crafted SSH packets (CVE-2019-3861)
     (Closes: #924965)
   * Out-of-bounds memory comparison (CVE-2019-3862) (Closes: #924965)
   * Integer overflow in user authenicate keyboard interactive allows
     out-of-bounds writes (CVE-2019-3863) (Closes: #924965)
   * Fixed misapplied patch for user auth.
   * moved MAX size declarations
Checksums-Sha1: 
 2d2cd964579e4da0e4400d1afc2d8ed090d4bd80 2046 libssh4_1.7.0-1+deb9u1.dsc
 02fef9bdafce3da466b36581a4ff53d519637aca 811714 libssh4_1.7.0.orig.tar.gz
 0a03504ad60b6d9b0a442af136c61581e39fdcbc 13008 libssh4_1.7.0-1+deb9u1.debian.tar.xz
Checksums-Sha256: 
 dc4db042d18ecd49012df85a8de5b8dd3b512300688b0e9f527a4c505fabe5f1 2046 libssh4_1.7.0-1+deb9u1.dsc
 e4561fd43a50539a8c2ceb37841691baf03ecb7daf043766da1b112e4280d584 811714 libssh4_1.7.0.orig.tar.gz
 e0291b5d7ff5a67abd318b923650569d2d4c112122a7b7b97cc3c563f10ae296 13008 libssh4_1.7.0-1+deb9u1.debian.tar.xz
Files: 
 225f26c2f549206bd1ea20fba48272f7 2046 libs optional libssh4_1.7.0-1+deb9u1.dsc
 b01662a210e94cccf2f76094db7dac5c 811714 libs optional libssh4_1.7.0.orig.tar.gz
 b7cb2434567f23fe89b298c810f8445d 13008 libs optional libssh4_1.7.0-1+deb9u1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlymeGpfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89E1XgP/34zYXXruFjbFjVBCFDnBsL4uVane5aB
/17AAuHRuJ6ssfEdtGtTZC+QgQmRUzTv/MqvKStYbXHapPTPHa29iLhBPxnYeBC8
Z62Va3ml6p0kYt/+jnAAASC+1w7JJC75L0q70kfM6ElQsh+BYvBdmOSX6P0rHNdH
U6duAAwfJWE8Kp7PjYK4+nePTo4Y3YoA5v+fTQGnsoUT8euSGqr0srZl4eSmunPk
YZ5NYvkNVCVY1tFYHykMVc7fdBMhrt6xBZqMYm4WDeIR2GPYDdg9XK5cHDL2a3ZU
9Be1D67o33yxAOS4vEFjK9m1fxrCEAnTvcvlV3xzHRMB6TOKeWfisnXiksHwf8pS
zZeoaWzpykwA4kpu0jOwhw3Qy91VpIKGAfOANC+l0vkkD22Qz3Tm3umyTHM/1weW
9GP6BAFb+h4k6ia12nV4Z4XTYc9SJTM5F/SP0YrI4zMjQqDe4jfzcX3mO9yx5W5T
wUMjVMZLSD/DFqplFNSJY6k461pZR3zlRUlJ9JFtHU4coiOWzcMqSp3y9oTZsUDZ
f2g2x7uC40125Zpnh5LYvyg6aj+IljdokIDlmg0fQkaT7bETZikOsNhbKsYXBvk0
ymJPZ0HAnrdB3JWXAOs4xDrmWX7uRbStTw+wbg+G8uBTC5UnKl3Z2gVC4uTcjOB9
qWI/DwUZ4TsV
=ToQJ
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.