This bug was fixed in the package openssh - 1:7.6p1-4ubuntu0.7
---------------
openssh (1:7.6p1-4ubuntu0.7) bionic; urgency=medium
* d/p/fix-connect-timeout-overflow.patch: prevent ConnectTimeout overflow.
(LP: #1903516)
[ Sergio Durigan Junior ]
* d/p/lp1966591-upstream-preserve-group-world-read-permission-on-kno.patch:
Preserve group/world read permissions on known_hosts. (LP: #1966591)
-- Athos Ribeiro <athos.ribe...@canonical.com> Wed, 30 Mar 2022
10:17:14 -0300
** Changed in: openssh (Ubuntu Bionic)
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/1903516
Title:
aborted (core dumped) when using ConnectTimeout > 2147483
Status in portable OpenSSH:
Unknown
Status in openssh package in Ubuntu:
Fix Released
Status in openssh source package in Bionic:
Fix Released
Status in openssh source package in Focal:
Fix Released
Status in openssh source package in Impish:
Fix Committed
Status in openssh source package in Jammy:
Fix Released
Bug description:
[Impact]
Setting ConnectTimeout to a value higher than INT_MAX/1000 causes the
ssh client to crash. This happens due to an integer overflow which was
fixed upstream with the patch being proposed for this SRU, which caps
the effective value for that option at INT_MAX/1000.
While use cases triggering the bug may be uncommon, the patch is
straightforward and the fix could be staged for the next time an
upload is needed.
[Test Plan]
Running
ssh -o "ConnectTimeout=$(perl -e 'use POSIX; my $max =
int(POSIX::INT_MAX/1000)+1; print "$max\n";')" localhost
triggers the error. In this case, the ssh client will crash and
Aborted
will be printed to stderr.
By applying the proposed fix, running the same command should allow
the ssh connection to proceed to the authentication steps.
[Where problems could occur]
Most problems would manifest due to rebuilding the package (e.g.,
dependency changes). Since this proposal is to stage these SRUs, such
risk is being deferred to be shared with the next, more critical,
upload.
[Other Info]
All the SRUs proposed here should be staged due to the low priority nature of
the bug.
[Original bug report]
The ssh client fails with the message "Aborted (core dumped)" when
setting the ConnectTimeout to 2147484 or higher.
lsb_release: Linux Mint 20 (but also tested this on latest ubuntu:20.04
docker container)
openssh-client version: 1:8.2p1-4ubuntu0.1
I expected that either the connect timeout would be used correctly, or
that it would fail with a proper error message saying the connect
timeout can't be higher than 2147483.
What happened:
$ ssh -o "ConnectTimeout=2147484" localhost
Aborted (core dumped)
To manage notifications about this bug go to:
https://bugs.launchpad.net/openssh/+bug/1903516/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
