On Wed, Mar 30, 2022 at 08:53:47PM +0200, Christian Melki wrote: > On 3/30/22 19:48, Michael Olbrich wrote: > > On Wed, Mar 30, 2022 at 03:25:39PM +0200, Christian Melki wrote: > >> Security miss, integer overflow in the user auth path. > >> Not exploitable due to privsep. > >> > >> * Update license. md5crypt removed, bcrypt relicensed. > >> 4-Clause license removed. > >> * Minor spelling fixes in the license file. > >> * Remove configure option due to the removal of md5crypt. > > > > Fails to build here with: > > > > ssherr.c: In function 'ssh_err': > > ssherr.c:151:1: sorry, unimplemented: '-fzero-call-used-regs' not supported > > on this target > > make: *** [Makefile:200: ssherr.o] Error 1 > > > > The stange thing is there is a configure check for it that that one > > succeeds: > > > > checking if arm-v7a-linux-gnueabihf-gcc supports compile flag > > -fzero-call-used-regs=all... yes > > > > Michael > > > > Ack. Will look into it. Could you please tell me which gcc version > you've used? > I've successfully built it for an armv7-a target, but I am using 11.2.
gcc 11.1 from OSELAS.Toolchain-2021.07.0. Or maybe this was triggered by one of the hardening options in the platformconfig: PTXCONF_TARGET_HARDEN_STACK_STRONG=y PTXCONF_TARGET_HARDEN_FORTIFY=y PTXCONF_TARGET_HARDEN_RELRO=y PTXCONF_TARGET_HARDEN_BINDNOW=y PTXCONF_TARGET_HARDEN_PIE=y PTXCONF_TARGET_HARDEN_GLIBCXX_ASSERTIONS=y Michael > >> Signed-off-by: Christian Melki <[email protected]> > >> --- > >> rules/openssh.make | 11 +++++------ > >> 1 file changed, 5 insertions(+), 6 deletions(-) > >> > >> diff --git a/rules/openssh.make b/rules/openssh.make > >> index c801d8a6a..8f48e426e 100644 > >> --- a/rules/openssh.make > >> +++ b/rules/openssh.make > >> @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_OPENSSH) += openssh > >> # > >> # Paths and names > >> # > >> -OPENSSH_VERSION := 8.8p1 > >> -OPENSSH_MD5 := 8ce5f390958baeeab635aafd0ef41453 > >> +OPENSSH_VERSION := 8.9p1 > >> +OPENSSH_MD5 := f33910174f0af52491277211e2b105bb > >> OPENSSH := openssh-$(OPENSSH_VERSION) > >> OPENSSH_SUFFIX := tar.gz > >> OPENSSH_URL := \ > >> @@ -25,8 +25,8 @@ OPENSSH_URL := \ > >> > >> OPENSSH_SOURCE := $(SRCDIR)/$(OPENSSH).$(OPENSSH_SUFFIX) > >> OPENSSH_DIR := $(BUILDDIR)/$(OPENSSH) > >> -OPENSSH_LICENSE := BSD AND BSD-2-Clause AND BSD-3-Clause AND > >> BSD-4-Clause AND MIT AND Beerware AND ISC > >> -OPENSSH_LICENSE_FILES := > >> file://LICENCE;md5=d9d2753bdef9f19466dc7bc959114b11 > >> +OPENSSH_LICENSE := BSD AND BSD-2-Clause AND BSD-3-Clause AND MIT AND > >> Beerware AND ISC > >> +OPENSSH_LICENSE_FILES := > >> file://LICENCE;md5=8baf365614c9bdd63705f298c9afbfb9 > >> > >> # > >> ---------------------------------------------------------------------------- > >> # Prepare > >> @@ -78,8 +78,7 @@ OPENSSH_CONF_OPT := \ > >> --with-privsep-user=sshd \ > >> --with-sandbox=$(OPENSSH_SANDBOX-y) \ > >> --$(call ptx/wwo, PTXCONF_GLOBAL_SELINUX)-selinux \ > >> - --with-privsep-path=/var/run/sshd \ > >> - --without-md5-passwords > >> + --with-privsep-path=/var/run/sshd > >> > >> # > >> ---------------------------------------------------------------------------- > >> # Target-Install > >> -- > >> 2.32.0 > >> > >> > >> _______________________________________________ > >> ptxdist mailing list > >> [email protected] > >> To unsubscribe, send a mail with subject "unsubscribe" to > >> [email protected] > >> > > > > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | _______________________________________________ ptxdist mailing list [email protected] To unsubscribe, send a mail with subject "unsubscribe" to [email protected]
