diff options
Diffstat (limited to 'debian/patches/CVE-2023-28531.patch')
| -rw-r--r-- | debian/patches/CVE-2023-28531.patch | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/debian/patches/CVE-2023-28531.patch b/debian/patches/CVE-2023-28531.patch new file mode 100644 index 0000000..448632a --- /dev/null +++ b/debian/patches/CVE-2023-28531.patch @@ -0,0 +1,31 @@ +From d1461c936223751e723662115b12bb0e9ba96f65 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" <djm@openbsd.org> +Date: Thu, 9 Mar 2023 06:58:26 +0000 +Subject: upstream: include destination constraints for smartcard keys too. + +Spotted by Luci Stanescu; ok deraadt@ markus@ + +OpenBSD-Commit-ID: add879fac6903a1cb1d1e42c4309e5359c3d870f + +Bug-Debian: https://bugs.debian.org/1033166 +Origin: backport, https://anongit.mindrot.org/openssh.git/commit/?id=54ac4ab2b53ce9fcb66b8250dee91c070e4167ed +Last-Update: 2023-12-19 + +Patch-Name: CVE-2023-28531.patch +--- + authfd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/authfd.c b/authfd.c +index b633e35ea..b9ae505ad 100644 +--- a/authfd.c ++++ b/authfd.c +@@ -666,7 +666,7 @@ ssh_update_card(int sock, int add, const char *reader_id, const char *pin, + struct dest_constraint **dest_constraints, size_t ndest_constraints) + { + struct sshbuf *msg; +- int r, constrained = (life || confirm); ++ int r, constrained = (life || confirm || dest_constraints); + u_char type; + + if (add) { |