putty: CVE-2015-2157

Debian Bug report logs - #779488
putty: CVE-2015-2157

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: putty: CVE-2015-2157

Date: Sun, 01 Mar 2015 13:21:32 +0100

Package: putty
Severity: important
Tags: security

This has been assigned CVE-2015-2157:
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html

Cheers,
        Moritz

Message #10 received at 779488-close@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: 779488-close@bugs.debian.org

Subject: Bug#779488: fixed in putty 0.63-10

Date: Sun, 01 Mar 2015 19:50:01 +0000

Source: putty
Source-Version: 0.63-10

We believe that the bug you reported is fixed in the latest version of
putty, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 779488@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Colin Watson <cjwatson@debian.org> (supplier of updated putty package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 01 Mar 2015 12:59:15 +0000
Source: putty
Binary: pterm putty putty-tools putty-doc
Architecture: source amd64 all
Version: 0.63-10
Distribution: unstable
Urgency: medium
Maintainer: Colin Watson <cjwatson@debian.org>
Changed-By: Colin Watson <cjwatson@debian.org>
Description:
 pterm      - PuTTY terminal emulator
 putty      - Telnet/SSH client for X
 putty-doc  - PuTTY HTML documentation
 putty-tools - command-line tools for SSH, SCP, and SFTP
Closes: 779488
Changes:
 putty (0.63-10) unstable; urgency=medium
 .
   * Backport from upstream:
     - Make kh4reg.py compatible with modern Python.
     - MATTA-2015-002: Enforce acceptable range for Diffie-Hellman server
       value.
     - Fix an erroneous length field in SSH-1 key load.
     - CVE-2015-2157: Fix failure to clear sensitive private key information
       from memory (closes: #779488).
Checksums-Sha1:
 ce15a429e5a9651c71b1eb88ed5656a62661dfb2 2060 putty_0.63-10.dsc
 2aa78fae6bac5008086b7c5f84c3928242426de7 61800 putty_0.63-10.debian.tar.xz
 cc51c452cec5a7933cbf55d64a9ac51358ba3546 182346 pterm_0.63-10_amd64.deb
 132ae2a0efd02b44e81406279d2992a8d01daa48 309632 putty_0.63-10_amd64.deb
 2a28d7b06ae000de74b69fb6ae22d2b65974443b 322506 putty-tools_0.63-10_amd64.deb
 2394f56634cc2bf4a89d03f8788ddb179bb0560a 136386 putty-doc_0.63-10_all.deb
Checksums-Sha256:
 3a464b0525b3daf717af56b89398ee4282cefa3d130b5de88029b74d5149e5ad 2060 putty_0.63-10.dsc
 cb09afa6bfe72460e4c4f43f328f3baef52f93f299dac3e92f5c045ffd499d95 61800 putty_0.63-10.debian.tar.xz
 7e64961f117b0eb8e590f21312119efad4740feafc45c36fa9689e52ea0d331f 182346 pterm_0.63-10_amd64.deb
 a6ea3d1b6c3a19f5097cbd96af61dcae0d2d4c139c6c76acac3955ae350a7adb 309632 putty_0.63-10_amd64.deb
 3df90f6cc0f0dc956a95bdf6402f016a525e557a408d1bea753652814187e90d 322506 putty-tools_0.63-10_amd64.deb
 0b0e7929fcc04a29a2d595ce2d06257d1842fb3d27f23ced4d38bd98c3a592bb 136386 putty-doc_0.63-10_all.deb
Files:
 3e16d1383744af7dcc3eee7a3c4f38c1 2060 net optional putty_0.63-10.dsc
 189001650a7012c7658a289ed9f70a74 61800 net optional putty_0.63-10.debian.tar.xz
 c4e70211bba534ab1790aa7251c236f9 182346 x11 optional pterm_0.63-10_amd64.deb
 8af2faf29bcc5ca81c411ec3826b6644 309632 net optional putty_0.63-10_amd64.deb
 035ee192ef71cd5384264062aaf884cc 322506 net optional putty-tools_0.63-10_amd64.deb
 1c01b8361e4e45d425238cc80130bb64 136386 doc optional putty-doc_0.63-10_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Colin Watson <cjwatson@debian.org> -- Debian developer

iQIVAwUBVPNpIzk1h9l9hlALAQi8PQ/9FX4iCT8KJnWnt70NJxbbcsKQYiALzyx8
DmWF2vL5eUr7eGihz5w7BnIIsQjK2G11nCy9+XFD/UzHtucZP4DqC/0cwLQ8FlfW
rXIWI/wWdFSFD9waYGPLGtbK/iComhQCYuSiqGOdacOv51mgvxiiTSEM4tzOK/yA
m0oj2LlXHPWdLb3/kDZHZzYnzaT/1gW9gGNgd86HdNV6HO1BGVaovDctZ1dhzj2X
oam5asP1VzCmOAhWQjo9hTfuLO57KELeV5gzH07bmaSBa3wTOpdhik3msW4v96/r
OoywTDiEy5wBzGj3Rlg8QKVPXM8m/Lz+2ndeUgHcsXHyyQtDWKFwHctS65MBCbyz
jxioFJzwq+iXZYDDAmnFHxIfBzkfTaDjmaTvyhWPP1orutsQp0MlZYr5xeIdtwYk
5OrGUudESIh+jCNgPWEg+wwGfDtt/H4l8lLMPr/JZaK0WpRzeYWi2Rz142fG/xms
Z+bLN8JJhju383oH761WvTeOnusatL2KanVEXfXmdow/LqlCHenzxu5gzndKHF6l
k9w5a/lcu5Y6uV6XCl0X4akeeIi/9H/LeR6N7V110CGM8DpnLBUscDQ/G98QvUOR
lDXrm1F+mp4bzGXbtCTIOBkJH1BWg5Wgl6x0JDohsEtshU+fNDcdCsONj6EQ05Aa
u9RZnHUNnTw=
=BIS3
-----END PGP SIGNATURE-----

Message #15 received at 779488@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: Moritz Muehlenhoff <jmm@inutil.org>, 779488@bugs.debian.org

Cc: team@security.debian.org

Subject: Re: Bug#779488: putty: CVE-2015-2157

Date: Sun, 1 Mar 2015 20:21:17 +0000

[Message part 1 (text/plain, inline)]

On Sun, Mar 01, 2015 at 01:21:32PM +0100, Moritz Muehlenhoff wrote:
> This has been assigned CVE-2015-2157:
> http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html

Thanks.  Fixed in unstable and unblocked.  I'd like to upload the
attached debdiff to stable-security; would that be OK?  I can also work
on a squeeze-lts upload once this is done.

-- 
Colin Watson                                       [cjwatson@debian.org]

[putty_0.62-9+deb7u2.debdiff (text/plain, attachment)]

Message #24 received at 779488@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: Moritz Muehlenhoff <jmm@inutil.org>, 779488@bugs.debian.org

Cc: team@security.debian.org

Subject: Re: Bug#779488: putty: CVE-2015-2157

Date: Sun, 1 Mar 2015 21:18:39 +0000

[Message part 1 (text/plain, inline)]

On Sun, Mar 01, 2015 at 08:21:17PM +0000, Colin Watson wrote:
> On Sun, Mar 01, 2015 at 01:21:32PM +0100, Moritz Muehlenhoff wrote:
> > This has been assigned CVE-2015-2157:
> > http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html
> 
> Thanks.  Fixed in unstable and unblocked.  I'd like to upload the
> attached debdiff to stable-security; would that be OK?  I can also work
> on a squeeze-lts upload once this is done.

That'll teach me to send mail before testing.  Here's a corrected
version that actually builds.

-- 
Colin Watson                                       [cjwatson@debian.org]

[putty_0.62-9+deb7u2.debdiff (text/plain, attachment)]

Message #29 received at 779488@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Colin Watson <cjwatson@debian.org>

Cc: 779488@bugs.debian.org, team@security.debian.org

Subject: Re: Bug#779488: putty: CVE-2015-2157

Date: Sun, 1 Mar 2015 22:27:11 +0100

On Sun, Mar 01, 2015 at 09:18:39PM +0000, Colin Watson wrote:
> On Sun, Mar 01, 2015 at 08:21:17PM +0000, Colin Watson wrote:
> > On Sun, Mar 01, 2015 at 01:21:32PM +0100, Moritz Muehlenhoff wrote:
> > > This has been assigned CVE-2015-2157:
> > > http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html
> > 
> > Thanks.  Fixed in unstable and unblocked.  I'd like to upload the
> > attached debdiff to stable-security; would that be OK?  I can also work
> > on a squeeze-lts upload once this is done.
> 
> That'll teach me to send mail before testing.  Here's a corrected
> version that actually builds.

Thanks! Please upload.

Cheers,
        Moritz

Message #34 received at 779488-close@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: 779488-close@bugs.debian.org

Subject: Bug#779488: fixed in putty 0.60+2010-02-20-1+squeeze3

Date: Sun, 15 Mar 2015 18:03:49 +0000

Source: putty
Source-Version: 0.60+2010-02-20-1+squeeze3

We believe that the bug you reported is fixed in the latest version of
putty, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 779488@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Colin Watson <cjwatson@debian.org> (supplier of updated putty package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 15 Mar 2015 17:44:52 +0000
Source: putty
Binary: pterm putty putty-tools putty-doc
Architecture: source i386 all
Version: 0.60+2010-02-20-1+squeeze3
Distribution: squeeze-lts
Urgency: high
Maintainer: Colin Watson <cjwatson@debian.org>
Changed-By: Colin Watson <cjwatson@debian.org>
Description: 
 pterm      - PuTTY terminal emulator
 putty      - Telnet/SSH client for X
 putty-doc  - PuTTY HTML documentation
 putty-tools - command-line tools for SSH, SCP, and SFTP
Closes: 779488
Changes: 
 putty (0.60+2010-02-20-1+squeeze3) squeeze-lts; urgency=high
 .
   * Backport from upstream:
     - MATTA-2015-002: Enforce acceptable range for Diffie-Hellman server
       value.
     - Fix an erroneous length field in SSH-1 key load.
     - CVE-2015-2157: Fix failure to clear sensitive private key information
       from memory (closes: #779488).
Checksums-Sha1: 
 259c4db7aa48a18b1b0934a6916387200a10c8ac 1976 putty_0.60+2010-02-20-1+squeeze3.dsc
 bf5cf1f9d0dbb2584fa8583cf5b3dd726d13b341 23228 putty_0.60+2010-02-20-1+squeeze3.debian.tar.gz
 b81bbf41a9a1799fb6f4a54e5ed3b4dd44bc7e22 183604 pterm_0.60+2010-02-20-1+squeeze3_i386.deb
 b7464b2519d85e2b28cfd60f56f09e6f0af28690 307464 putty_0.60+2010-02-20-1+squeeze3_i386.deb
 29db91ab190b7ee68fa78d82141eff6a3b4871e6 614816 putty-tools_0.60+2010-02-20-1+squeeze3_i386.deb
 ae5df22877b4fd38ee71fc1aff73e06151b8d74b 171946 putty-doc_0.60+2010-02-20-1+squeeze3_all.deb
Checksums-Sha256: 
 80afa99eeaf10dd455686f18ffdcd5561f2a1357efed8b089c8f1203a553812d 1976 putty_0.60+2010-02-20-1+squeeze3.dsc
 9f6e0a4f11b653d8deb5c6163c83f4fb6d5ea9ccfed8b132d9db70d771a08547 23228 putty_0.60+2010-02-20-1+squeeze3.debian.tar.gz
 de0b2d0899ca92ce6e2b3839c4a1334040cfb8a546fc4d579c305e5bec3e5d88 183604 pterm_0.60+2010-02-20-1+squeeze3_i386.deb
 3186fae04c9940bb7b7852d424ede90eefade93448daf661951e45d620b8ed25 307464 putty_0.60+2010-02-20-1+squeeze3_i386.deb
 36491d8dc7123e6944ed106e16438606425f069879fdea322cbbbfd425e4e92a 614816 putty-tools_0.60+2010-02-20-1+squeeze3_i386.deb
 62d1322881bc87a1a95c8f0d42d881c74e7be8a4a5f99fbe1ca01f3a99eb5f35 171946 putty-doc_0.60+2010-02-20-1+squeeze3_all.deb
Files: 
 0256371b93088d82c8f55832f6990c91 1976 net optional putty_0.60+2010-02-20-1+squeeze3.dsc
 9ba6f2b31c2572386a2b79c8e7d4c0cf 23228 net optional putty_0.60+2010-02-20-1+squeeze3.debian.tar.gz
 ded5db5cf42fccf4ec64d3497de6d45d 183604 x11 optional pterm_0.60+2010-02-20-1+squeeze3_i386.deb
 4393c72e5f23ff1d6a1134a3bf64b731 307464 net optional putty_0.60+2010-02-20-1+squeeze3_i386.deb
 24712d6717ca7733cceba591f4502986 614816 net optional putty-tools_0.60+2010-02-20-1+squeeze3_i386.deb
 bf86731028c50d85363365ae222d9726 171946 doc optional putty-doc_0.60+2010-02-20-1+squeeze3_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Colin Watson <cjwatson@debian.org> -- Debian developer

iQIVAwUBVQXHDTk1h9l9hlALAQgwYA//ddpKsMp31PUtsFFSZWhDQLoys1933r0f
Vf+Nr4XVnhG4WtjC9pVXsPnWHgEsj4W7nYdmDpXTmTmPKMeub/pDYuxuErJXIMOg
9i5mFh4PinXQuB1HNv0RWchzzBaIBjJ9DH41QOlGk0Uyycym/JisPD1O8IE24Qap
Br4po78hMTSMoBlAuz5HZF3aLfQoxbGUocVXJB08/d7WpNglyvvabIGyiiB3ZPw4
xXuG5gmPpGomQhkvL2ziB05Qa02BghjnempuwWdPGhwju05YeGFfQSJbGKE9pRWB
8BLqG9MGdNw1UhHSwv/TWbpRcr+F5Fso4e52czvQRmIy5uZZnja3ZlT5jKZXvhgD
BlnCBc2fz58crB30uwKoqndpA7rBGxbSNGXak4Qy8j5bxTlz9Baj5nfvzE/kELfJ
qRiSXRLD1Thv5duHmjTlIeYAj46x5tq+8i/xgW2vVoSZdC5kAJsjoq+S412aZXZD
XHF4MvW2182wHG9QxivLXLhMd8AKKGHwhH7JRUSN9J5cI7N7SWP90wrM/fzGG1p2
YILADv6+iDtwcBaYKES71RJFPBQikqgeYrQJtFcOlE+2Uke4UywQMRV7BESGMoXd
uIi+Ss/f5UD8mnrEEC7YBcIZX30jFQTg9lApfS6C01iLh0Tt7c1/R/6VUCG06ZrI
shvSobWFanQ=
=F/ll
-----END PGP SIGNATURE-----

Message #39 received at 779488-close@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: 779488-close@bugs.debian.org

Subject: Bug#779488: fixed in putty 0.62-9+deb7u2

Date: Tue, 17 Mar 2015 22:18:17 +0000

Source: putty
Source-Version: 0.62-9+deb7u2

We believe that the bug you reported is fixed in the latest version of
putty, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 779488@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Colin Watson <cjwatson@debian.org> (supplier of updated putty package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sat, 14 Mar 2015 12:56:58 +0000
Source: putty
Binary: pterm putty putty-tools putty-doc
Architecture: source amd64 all
Version: 0.62-9+deb7u2
Distribution: stable-security
Urgency: high
Maintainer: Colin Watson <cjwatson@debian.org>
Changed-By: Colin Watson <cjwatson@debian.org>
Description: 
 pterm      - PuTTY terminal emulator
 putty      - Telnet/SSH client for X
 putty-doc  - PuTTY HTML documentation
 putty-tools - command-line tools for SSH, SCP, and SFTP
Closes: 779488
Changes: 
 putty (0.62-9+deb7u2) stable-security; urgency=high
 .
   * Backport from upstream:
     - MATTA-2015-002: Enforce acceptable range for Diffie-Hellman server
       value.
     - Fix an erroneous length field in SSH-1 key load.
     - CVE-2015-2157: Fix failure to clear sensitive private key information
       from memory (closes: #779488).
Checksums-Sha1: 
 54134f04eb8db63de626c16fd9fdada69421db21 2051 putty_0.62-9+deb7u2.dsc
 5a32df7e44bb28c381399a54dd9759adb049abf9 30421 putty_0.62-9+deb7u2.debian.tar.gz
 bab480bacffa75c94274bffa188ccbdb53b7878e 205910 pterm_0.62-9+deb7u2_amd64.deb
 7bb4f9ca9ae36d8e1e6730f7eeb3092759741134 351962 putty_0.62-9+deb7u2_amd64.deb
 0dc05166834d4bcaf1693593bd2b0677704770d0 718322 putty-tools_0.62-9+deb7u2_amd64.deb
 f7e7a8b8e149fa9edf70a530814b714a092f1c74 174764 putty-doc_0.62-9+deb7u2_all.deb
Checksums-Sha256: 
 998258a0faaa6a5a2ec683e679dd1591b6cbfd74413a4e1ef6bf7ab930519a29 2051 putty_0.62-9+deb7u2.dsc
 1e8a455334d4abfb6d449c0e437b2f1083fad0264326b0ed998186b68915412a 30421 putty_0.62-9+deb7u2.debian.tar.gz
 a861f858db8345e750e684ac3b129afb23d2b1d72e7a921abdf32cfdb44ae4c0 205910 pterm_0.62-9+deb7u2_amd64.deb
 e0dc100cb8232bfc530caefb2331e632c7e1ab804c103fecfa6509cc66839d5b 351962 putty_0.62-9+deb7u2_amd64.deb
 8283a70f3d7bf3e29ecb0b95389b730a92714044e68f67c2b1191b129288ff8a 718322 putty-tools_0.62-9+deb7u2_amd64.deb
 fc5ebd7520129de338bfb84e50a5ecc34cb76fa66182efccbec722c6b2668cc8 174764 putty-doc_0.62-9+deb7u2_all.deb
Files: 
 aa2827441637ec7ab6092b3b074cd345 2051 net optional putty_0.62-9+deb7u2.dsc
 1f4ff5d7be8cd2d344f1cf97b5cc6834 30421 net optional putty_0.62-9+deb7u2.debian.tar.gz
 85d8e54cb12d1636b80010fe5b518ea4 205910 x11 optional pterm_0.62-9+deb7u2_amd64.deb
 850620168fd3e509ab20faf12d1726b4 351962 net optional putty_0.62-9+deb7u2_amd64.deb
 e6e0bf8514286c8fb2cd7cb9f2bf840f 718322 net optional putty-tools_0.62-9+deb7u2_amd64.deb
 e8e172cb5515350ebf54006e79103deb 174764 doc optional putty-doc_0.62-9+deb7u2_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Colin Watson <cjwatson@debian.org> -- Debian developer

iQIVAwUBVQQzZjk1h9l9hlALAQgK0hAAnpNAOtOL0kkJTb6D8E6gtUeSLENS7NQf
rSzaub9AziQrvbx68mZxNelO5kWJXh4xLc2w0TMv73Hgvom6eBebctNTC9IGW5U7
A1+2BvUEtIx5Pd3Sy/YrZPpXgOOEG8PeX1R+4bmyaqk2BuU4xLbLp1hZPH/Vsb5R
Oc/kdzEHJ7iPGzn0tyJNt1SloibfP/IHs9HiW6T5g2BmdQCw/0ZJ8U+9pgGTjtv6
4FWnDCPnAOxGhWouVOQ4IDCt+SbVG0UcV/qxs2NtHE8Qch98bxMlHXIAasfe7x7j
gkWab9ldTkqjNEQRSLQ/Qy5jzYcabpHWbK7M/KmRsLbLrtwYo3+/Dzwk7UWziaUV
BRQJpNP3LOKlh7e3cQ70JLGpRXU02nkQYYtoDV2ABZ3RwDfJAVCul+7aXneppZre
1smgflb5YzC2HekRHR2MfA9v9yS0JoLS7o9zKwULIOeQjcXuY4avlpzrLzrQcdpm
R+mSOW+imN4XU1654B9pjPSyHoBnk61ZffhY3OG9gy1z2rbLSqaL8tJdkku8mT8d
pRfNgIthCe9gVH+G9XItnKyHIr+zvR8UDzuo59ptTUtBasF8OLoWONqUp4q1hGOJ
ChPhOKo/IiXAnZE/1pbydIcQDNYkS9dx6JlGKRzrou7qveFPFnFOhsgtr46Ok5ZL
fUtUCTL0uUo=
=iatl
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.