group.of.nepali.translators team mailing list archive

[Launchpad Bug Tracker <1805348@xxxxxxxxxxxxxxxxxx>]

This bug was fixed in the package libssh -
0.8.0~20170825.94fa1e38-1ubuntu0.2

---------------
libssh (0.8.0~20170825.94fa1e38-1ubuntu0.2) bionic-security; urgency=medium

  * SECURITY REGRESSION: fix multiple regressions (LP: #1805348)
    - debian/patches/CVE-2018-10933-regression.patch: set correct state
      after sending INFO_REQUEST in src/server.c.
    - debian/patches/CVE-2018-10933-regression2.patch: add missing break in
      src/packet.c.
    - debian/patches/CVE-2018-10933-regression3.patch: set correct state
      after sending GSSAPI_RESPONSE in src/gssapi.c.

 -- Marc Deslauriers <marc.deslauriers@xxxxxxxxxx>  Tue, 27 Nov 2018
10:01:15 -0500

** Changed in: libssh (Ubuntu Bionic)
       Status: Triaged => Fix Released

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1805348

Title:
  Recent security update broke server-side keyboard-interactive
  authentication

Status in libssh package in Ubuntu:
  Fix Released
Status in libssh source package in Trusty:
  Fix Released
Status in libssh source package in Xenial:
  Fix Released
Status in libssh source package in Bionic:
  Fix Released
Status in libssh source package in Cosmic:
  Fix Released
Status in libssh package in Debian:
  New

Bug description:
  0.8.4 and the backported fixes for CVE-2018-10933 cause server-side
  keyboard-interactive authentication to completely break. See
  https://bugs.libssh.org/T117 for details and a reproducer.

  This was fixed upstream as part of the 0.8.5 release, so disco is
  fine. For 16.04/18.04/18.10, please backport the fix:

    https://git.libssh.org/projects/libssh.git/commit/?id=4ea46eecce9f4

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libssh/+bug/1805348/+subscriptions