Bug#859655: [pkg-go] Bug#859655: golang-go.crypto: CVE-2017-3204

2017-04-15 Thread Antoine Beaupré
On 2017-04-15 11:04:31, Vincent Bernat wrote: > ❦ 14 avril 2017 15:07 -0400, anarcat  : > >> I looked into this during the Montreal BSP, and it's unclear what we >> should do here, considering there has been multiple new uploads since >> the stretch freeze. >> >> The patch is

Bug#859655: [pkg-go] Bug#859655: golang-go.crypto: CVE-2017-3204

2017-04-15 Thread Vincent Bernat
❦ 14 avril 2017 15:07 -0400, anarcat  : > I looked into this during the Montreal BSP, and it's unclear what we > should do here, considering there has been multiple new uploads since > the stretch freeze. > > The patch is pretty long: > >

Bug#859655: golang-go.crypto: CVE-2017-3204

2017-04-14 Thread anarcat
Control: user -1 debian-rele...@lists.debian.org Control: usertags -1 bsp-2017-04-ca-montreal Control: tags -1 +patch I looked into this during the Montreal BSP, and it's unclear what we should do here, considering there has been multiple new uploads since the stretch freeze. The patch is

Bug#859655: golang-go.crypto: CVE-2017-3204

2017-04-05 Thread Salvatore Bonaccorso
Source: golang-go.crypto Version: 1:0.0~git20161012.0.5f31782-1 Severity: grave Tags: upstream patch security Forwarded: https://github.com/golang/go/issues/19767 Hi, the following vulnerability was published for golang-go.crypto. CVE-2017-3204[0]: | The Go SSH library (x/crypto/ssh) by default