Bug 1682 - openssh was updated to apply CVE-2010-5107 patch [UPDATE REQUEST]
: openssh was updated to apply CVE-2010-5107 patch [UPDATE REQUEST]
Status: RESOLVED FIXED
Product: Desktop Bugs
Classification: ROSA Desktop
Component: Main Packages
: Marathon
: All Linux
: Normal normal
: ---
Assigned To: ROSA Linux Bugs
: ROSA Linux Bugs
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2013-02-18 13:13 MSK by Alexander Burmashev
Modified: 2013-02-21 11:07 MSK (History)
2 users (show)

See Also:
RPM Package: openssh
ISO-related:
Bad POT generating:
Upstream:
vladimir.potapov: qa_verified+
dmitry.romashkin: secteam_verified+
alex.burmashev: published+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Burmashev 2013-02-18 13:13:52 MSK
openssh was updated to apply CVE-2010-5107 patch
Comment 1 Alexander Burmashev 2013-02-18 13:16:03 MSK
Advisory:
A denial of service flaw was found in the way default server configuration of OpenSSH, a open source implementation of SSH protocol versions 1 and 2, performed management of its connection slot. A remote attacker could use this flaw to cause connection slot exhaustion on the server. Patch was applied to fix this issue.

References:
[1] http://seclists.org/oss-sec/2012/q1/1
[2] http://www.openwall.com/lists/oss-security/2013/02/06/5
[3] http://www.openwall.com/lists/oss-security/2013/02/07/3

Relevant upstream patches:
[4] http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/servconf.c?r1=1.234#rev1.234
[5] http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd_config.5?r1=1.156#rev1.156
[6] http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd_config?r1=1.89#rev1.89

Buildlists:
https://abf.rosalinux.ru/build_lists/958523
https://abf.rosalinux.ru/build_lists/958524
Comment 2 Vladimir Potapov 2013-02-20 15:15:08 MSK
openssh-5.8p2-4-rosa.lts2012.0
************************ Advisory ************************
Security fix CVE-2010-5107: A denial of service flaw was found in the way default server configuration of OpenSSH
**********************************************************
QA Verified