openssh: CVE-2016-8858: Memory exhaustion due to unregistered KEXINIT handler after receiving message

Debian Bug report logs - #841884
openssh: CVE-2016-8858: Memory exhaustion due to unregistered KEXINIT handler after receiving message

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: openssh: CVE-2016-8858: Memory exhaustion due to unregistered KEXINIT handler after receiving message

Date: Mon, 24 Oct 2016 08:45:53 +0200

Source: openssh
Version: 1:6.7p1-5
Severity: normal
Tags: security upstream

Hi,

the following vulnerability was published for openssh.

CVE-2016-8858[0]:
|Memory exhaustion due to unregistered KEXINIT handler after receiving
|message

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-8858
[1] http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/kex.c?rev=1.127&content-type=text/x-cvsweb-markup
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1384860

Regards,
Salvatore

Message #10 received at 841884-close@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: 841884-close@bugs.debian.org

Subject: Bug#841884: fixed in openssh 1:7.3p1-2

Date: Mon, 24 Oct 2016 11:42:28 +0000

Source: openssh
Source-Version: 1:7.3p1-2

We believe that the bug you reported is fixed in the latest version of
openssh, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 841884@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Colin Watson <cjwatson@debian.org> (supplier of updated openssh package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Mon, 24 Oct 2016 11:18:00 +0100
Source: openssh
Binary: openssh-client openssh-client-ssh4 openssh-server openssh-sftp-server ssh ssh-krb5 ssh-askpass-gnome openssh-client-udeb openssh-server-udeb
Architecture: source
Version: 1:7.3p1-2
Distribution: unstable
Urgency: high
Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>
Changed-By: Colin Watson <cjwatson@debian.org>
Description:
 openssh-client - secure shell (SSH) client, for secure access to remote machines
 openssh-client-ssh4 - secure shell (SSH) client for legacy SSH1 protocol
 openssh-client-udeb - secure shell client for the Debian installer (udeb)
 openssh-server - secure shell (SSH) server, for secure access from remote machines
 openssh-server-udeb - secure shell server for the Debian installer (udeb)
 openssh-sftp-server - secure shell (SSH) sftp server module, for SFTP access from remot
 ssh        - secure shell client and server (metapackage)
 ssh-askpass-gnome - interactive X program to prompt users for a passphrase for ssh-ad
 ssh-krb5   - secure shell client and server (transitional package)
Closes: 841884
Changes:
 openssh (1:7.3p1-2) unstable; urgency=high
 .
   * Rewrite debian/copyright using copyright-format 1.0.
   * CVE-2016-8858: Unregister the KEXINIT handler after message has been
     received (closes: #841884).
Checksums-Sha1:
 f55dc8702b29729b38531d4ceb060907b78d72f2 2884 openssh_7.3p1-2.dsc
 fce0bbab019bfd3a57e8b629cbf35297971d79c2 152132 openssh_7.3p1-2.debian.tar.xz
Checksums-Sha256:
 bae2b4b8eece5f0b7655512f4153ef0dbc60bcde47e88541a3a752b484436271 2884 openssh_7.3p1-2.dsc
 7adcc6249b689c3cc57144cfbf521a89e2ea91e34995a41e9698bcd2715cffda 152132 openssh_7.3p1-2.debian.tar.xz
Files:
 381129506ed873aa85034e881020b0b2 2884 net standard openssh_7.3p1-2.dsc
 f08cf4f79d939cc1e0ef6c5ab649acd8 152132 net standard openssh_7.3p1-2.debian.tar.xz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Colin Watson <cjwatson@debian.org> -- Debian developer

iQIVAwUBWA3nuDk1h9l9hlALAQiWDA/9GSN/me94XbMiqX7LO64L5xmncyaxKPWr
LaaFtkxChCDL+njkwHGoEUMqIUYTq0FSHR8pQyT6gxlaEEFwCNxH31IdUIcgYVFp
e3weYTWMPlvE3zbPdRAVzO3rUXW0lnqjQZb27uciixUahSpzPUyGbue/ESjB6C1x
9NMwKQjeaiXvl2C2ZZWoMCE+p0litNWAGkIcaEwpOvzKRNdmgHgI7mrDEcFGD/nO
pvht6AReaG+HF3QH8TiZ6tr/SU/b5ueglURYLkHuC9Pa/Twjm40KFTNuedynSzqg
5eO7tWg0GMedMPBn8kYpQhzsu5jMI5IXbn5V7mNjZpfjJilUjMCYiqRv+TSOoD2t
j6Mbdfsni47yF95rVOihbTyhoFwl6T3MBNMKBL3IOVBa8U54gRvATddXw7Ep0aan
XdRMQj4LINM+OypQzEtduxgiwB+fUqfTRBAaWVL7G0DdIwxdgWtXARlj4bJt0GPe
pexdOm2pTrd9Qcc0HQVKixsuM4/CxJDztF0LrH7TlilOhispnGZZBe15bsSPFUvs
TU1D2wqMygtcJqrouZ+TpzYI6gG4YVmwN5/Waa5ua5wR99PJjUcqPqAredv96O1z
WRu5SQPJRjON5lDzV+OJnp92huvHPi7p7TU4slZRDDgz4mh9iRTAO/tQ+/Tx7nA5
ToBwJqHdH5U=
=50l1
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.