| Message ID | 20231221140039.246333-1-peter@korsgaard.com |
|---|---|
| State | Accepted |
| Headers | show |
| Series | package/putty: security bump to version 0.80 | expand |
On Thu, 21 Dec 2023 15:00:39 +0100 Peter Korsgaard <peter@korsgaard.com> wrote: > As described in the announcement, this fixes a security issue: > > There is one security fix in this release: > > - Fix for a newly discovered security issue known as the 'Terrapin' > attack, also numbered CVE-2023-48795. The issue affects widely-used > OpenSSH extensions to the SSH protocol: the ChaCha20+Poly1305 > cipher system, and 'encrypt-then-MAC' mode. > > In order to benefit from the fix, you must be using a fixed version > of PuTTY _and_ a server with the fix, so that they can agree to > adopt a modified version of the protocol. Alternatively, you may be > able to reconfigure PuTTY to avoid selecting any of the affected > modes. > > If PuTTY 0.80 connects to an SSH server without the fix, it will > warn you if the initial protocol negotiation chooses an insecure > mode to run the connection in, so that you can abandon the > connection. If it's possible to alter PuTTY's configuration to > avoid the problem, then the warning message will tell you how to do > it. > > https://lists.tartarus.org/pipermail/putty-announce/2023/000037.html > > Signed-off-by: Peter Korsgaard <peter@korsgaard.com> > --- > package/putty/putty.hash | 8 ++++---- > package/putty/putty.mk | 2 +- > 2 files changed, 5 insertions(+), 5 deletions(-) Applied to master, thanks. Thomas
>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes: > As described in the announcement, this fixes a security issue: > There is one security fix in this release: > - Fix for a newly discovered security issue known as the 'Terrapin' > attack, also numbered CVE-2023-48795. The issue affects widely-used > OpenSSH extensions to the SSH protocol: the ChaCha20+Poly1305 > cipher system, and 'encrypt-then-MAC' mode. > In order to benefit from the fix, you must be using a fixed version > of PuTTY _and_ a server with the fix, so that they can agree to > adopt a modified version of the protocol. Alternatively, you may be > able to reconfigure PuTTY to avoid selecting any of the affected > modes. > If PuTTY 0.80 connects to an SSH server without the fix, it will > warn you if the initial protocol negotiation chooses an insecure > mode to run the connection in, so that you can abandon the > connection. If it's possible to alter PuTTY's configuration to > avoid the problem, then the warning message will tell you how to do > it. > https://lists.tartarus.org/pipermail/putty-announce/2023/000037.html > Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Committed to 2023.02.x and 2023.11.x, thanks.
diff --git a/package/putty/putty.hash b/package/putty/putty.hash index 0ae2a86be8..84569a31e5 100644 --- a/package/putty/putty.hash +++ b/package/putty/putty.hash @@ -1,7 +1,7 @@ -# Hashes from: http://the.earth.li/~sgtatham/putty/0.79/{sha1,sha256,sha512}sums -sha1 c40c3ce9fd334c40e64c6b33ee7e1096dad52701 putty-0.79.tar.gz -sha256 428cc8666fbb938ebf4ac9276341980dcd70de395b33164496cf7995ef0ef0d8 putty-0.79.tar.gz -sha512 4f10f870b229c89e928921d3b350955ce1c1170a062e7943d9cc8dbd83389d82a9b844623541605f0db5a429d545c2d188bf8e384c6515466fae69b216120983 putty-0.79.tar.gz +# Hashes from: http://the.earth.li/~sgtatham/putty/0.80/{sha1,sha256,sha512}sums +sha1 9c4a96f63ee3e927472191c935cc89228693c03a putty-0.80.tar.gz +sha256 2013c83a721b1753529e9090f7c3830e8fe4c80a070ccce764539badb3f67081 putty-0.80.tar.gz +sha512 c8a6b6fa54ecd8bcf4ec274fef51343dd9996e6458b250b5555c4dc88ded25e87f97277da482c29858510e65635112d541f559ab683635bd950572d850129f90 putty-0.80.tar.gz # Locally calculated sha256 7ede37f344ee03436c155a375ecb6cdb42a77105baa6e7804bf43260dc4a0c54 LICENCE diff --git a/package/putty/putty.mk b/package/putty/putty.mk index 4c9164d05e..bff6e78074 100644 --- a/package/putty/putty.mk +++ b/package/putty/putty.mk @@ -4,7 +4,7 @@ # ################################################################################ -PUTTY_VERSION = 0.79 +PUTTY_VERSION = 0.80 PUTTY_SITE = http://the.earth.li/~sgtatham/putty/$(PUTTY_VERSION) PUTTY_LICENSE = MIT PUTTY_LICENSE_FILES = LICENCE
As described in the announcement, this fixes a security issue: There is one security fix in this release: - Fix for a newly discovered security issue known as the 'Terrapin' attack, also numbered CVE-2023-48795. The issue affects widely-used OpenSSH extensions to the SSH protocol: the ChaCha20+Poly1305 cipher system, and 'encrypt-then-MAC' mode. In order to benefit from the fix, you must be using a fixed version of PuTTY _and_ a server with the fix, so that they can agree to adopt a modified version of the protocol. Alternatively, you may be able to reconfigure PuTTY to avoid selecting any of the affected modes. If PuTTY 0.80 connects to an SSH server without the fix, it will warn you if the initial protocol negotiation chooses an insecure mode to run the connection in, so that you can abandon the connection. If it's possible to alter PuTTY's configuration to avoid the problem, then the warning message will tell you how to do it. https://lists.tartarus.org/pipermail/putty-announce/2023/000037.html Signed-off-by: Peter Korsgaard <peter@korsgaard.com> --- package/putty/putty.hash | 8 ++++---- package/putty/putty.mk | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-)