packages/openssh
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix possible NULL deref when built without FIDO

Browse Source 
Signed-off-by: renmingshuai@huawei.com <renmingshuai@huawei.com>
This commit is contained in:
renmingshuai@huawei.com 2023-01-09 19:28:29 +08:00
parent 0618c94b22
commit b9e1a114af
2 changed files with 42 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
backport-fix-possible-NULL-deref-when-built-without-FIDO.patch Normal file
View File

@ -0,0 +1,33 @@
From 7d25b37fb2a5ff4dadabcbdac6087a97479434f5 Mon Sep 17 00:00:00 2001
From: Damien Miller <djm@mindrot.org>
Date: Fri, 24 Jun 2022 13:46:39 +1000
Subject: [PATCH] fix possible NULL deref when built without FIDO
Analysis/fix from kircher in bz3443; ok dtucker@
Reference:https://github.com/openssh/openssh-portable/commit/7d25b37fb2a5ff
Conflict:NA
---
ssh-sk.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/ssh-sk.c b/ssh-sk.c
index a1ff5cc4..ba514607 100644
--- a/ssh-sk.c
+++ b/ssh-sk.c
@@ -127,10 +127,11 @@ sshsk_open(const char *path)
ret->sk_enroll = ssh_sk_enroll;
ret->sk_sign = ssh_sk_sign;
ret->sk_load_resident_keys = ssh_sk_load_resident_keys;
+ return ret;
#else
error("internal security key support not enabled");
+ goto fail;
#endif
- return ret;
}
if ((ret->dlhandle = dlopen(path, RTLD_NOW)) == NULL) {
error("Provider \"%s\" dlopen failed: %s", path, dlerror());
--
2.23.0

10
openssh.spec
View File

@ -6,7 +6,7 @@
%{?no_gtk2:%global gtk2 0}
%global sshd_uid 74
%global openssh_release 16
%global openssh_release 17
Name: openssh
Version: 8.8p1
@ -106,6 +106,7 @@ Patch75: backport-upstream-avoid-integer-overflow-of-auth-attempts-har.pa
Patch76: backport-Skip-scp3-test-if-there-s-no-scp-on-remote-path.patch
Patch77: skip-scp-test-if-there-is-no-scp-on-remote-path-as-s.patch
Patch78: skip-tests-for-C-if-there-is-no-openssl-on-local-pat.patch
Patch79: backport-fix-possible-NULL-deref-when-built-without-FIDO.patch
Requires: /sbin/nologin
Requires: libselinux >= 2.3-5 audit-libs >= 1.0.8
@ -262,6 +263,7 @@ popd
%patch76 -p1
%patch77 -p1
%patch78 -p1
%patch79 -p1
autoreconf
pushd pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4
@ -460,6 +462,12 @@ getent passwd sshd >/dev/null || \
%attr(0644,root,root) %{_mandir}/man8/sftp-server.8*
%changelog
* Mon Jan 9 2023 renmingshuai <renmingshuai@huawei.com> - 8.8p1-17
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:fix possible NULL deref when built without FIDO
* Tue Jan 3 2023 renmingshuai <renmingshuai@huawei.com> - 8.8p1-16
- Type:bugfix
- CVE:NA