Opened 6 years ago

Closed 5 years ago

#57025 closed defect (fixed)

openssh @7.6p1_5: CVE-2018-15473

Reported by: l2dy (Zero King) Owned by: Ionic (Mihai Moldovan)
Priority: Normal Milestone:
Component: ports Version:
Keywords: security Cc: Schamschula (Marius Schamschula)
Port: openssh

Description


Attachments (1)

openssh.7.8p1-version-bump.diff​ (1.1 KB) - added by danielluke (Daniel J. Luke) 6 years ago.

Download all attachments as: .zip

Change History (7)

comment:1 Changed 6 years ago by Schamschula (Marius Schamschula)

Cc: Schamschula added

comment:2 Changed 6 years ago by Schamschula (Marius Schamschula)

Livecheck has openssh @7.8p1

comment:3 Changed 6 years ago by danielluke (Daniel J. Luke)

As per usual, a simple version bump works for the 'vanilla' port (but the hpn and gsskex variants probably require attention).

Changed 6 years ago by danielluke (Daniel J. Luke)

Attachment: openssh.7.8p1-version-bump.diff​ added

comment:4 Changed 5 years ago by danielluke (Daniel J. Luke)

8.0p1 is out now, and again a simple version bump works for the 'vanilla' port.

comment:5 Changed 5 years ago by Ionic (Mihai Moldovan)

Owner: set to Ionic
Status: new → accepted

comment:6 Changed 5 years ago by Mihai Moldovan <ionic@…>

Resolution: → fixed
Status: accepted → closed

In 715635bdfb881e287a52e23b298e379a4e9c03ac/macports-ports (master):

net/{openssh,ssh-copy-id}: update to 8.1p1.

Fixes: #56331
Fixes: #57025
Fixes: #58047
Fixes: #59009
Fixes: #59016

Changes:

  • Rebase patches.
  • Update to newer HPN patchset version. Based upon the 8.0p1 version 14.18 patch. Add a rebased OpenSSL-1.1-compat patch.
  • Switch to new ObjC-based Keychain integration as provided by Apple. Might fail on older platforms. If it does, we will need to bring back the old C-based implementation as an alternative for these.
  • Made the keychain integration and launchd startup patch a default one based upon request (and to be consistent with Apple's shipped OpenSSH version).
  • Portfile cleanup, don't define compile constants from outside - have autotools do that correctly.
  • Clarify where some of the patches come from - and especially for the gsskex patch that it is NOT a single patch taken from one location and rebased against the current OpenSSH version.
  • Renamed (now used) -m/-M options to -A/-K for the keychain integration.
Note: See TracTickets for help on using tickets.