it-securitynotifies AT lists.piratenpartei.de
Betreff: Sicherheitsankündigungen
Listenarchiv
- From: Sebastien Delafond <seb AT debian.org>
- To: debian-security-announce AT lists.debian.org
- Subject: [IT-SecNots] [SECURITY] [DSA 5599-1] phpseclib security update
- Date: Fri, 12 Jan 2024 07:12:52 +0000
- List-archive: https://lists.debian.org/msgid-search/E1rOBim-00BEfm-So AT seger.debian.org
- List-id: <debian-security-announce.lists.debian.org>
- List-url: <http://lists.debian.org/debian-security-announce/>
- Old-dkim-signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.seger; h=Date:Message-Id:Subject:To:From:Reply-To:Cc:MIME-Version: Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description: In-Reply-To:References; bh=9V3CozzpOhfgzkKfCAj/yp0G/4Q9s5G7EnEQUre8oUQ=; b=iN uJj9qEnsZPDgGdrwv6z/dh3952RolrGCBrqOq7eLMH/hJJNtFUunzS1AheLHtlfxv2EsmC2banO/B hy9Gu+q1637PFKnUf3WMZunlC8JgQpVvjtBZfvt6c7IsVGidUioXTynwzZ2T0z11o6STFaV+49jhJ 4hnJrnTCJ0Ajql3RjBVMQ6yt6kiSWiGvzzq6og4WFGvr6x66wzaauXvNIQWnZjRN4AIS6xuLWn3+q U4Jy+hxfyMRNzqYSTmx5nEzKzoZVlF3ol8Fqlczm5reU8exqzLfOkPpcdunUtmBVo/Y6UmJY3P5fb lO90Gy2HwYQuO4fIvhMMIobsIPYeI+uw==;
- Old-return-path: <seb AT seger.debian.org>
- Priority: urgent
- Resent-date: Fri, 12 Jan 2024 07:13:27 +0000 (UTC)
- Resent-from: debian-security-announce AT lists.debian.org
- Resent-message-id: <2tON4J2MjtG.A.B_.XaOolB@bendel>
- Resent-sender: debian-security-announce-request AT lists.debian.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5599-1 security AT debian.org
https://www.debian.org/security/ Sebastien Delafond
January 12, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : phpseclib
CVE ID : CVE-2023-48795
Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the
SSH protocol is prone to a prefix truncation attack, known as the
"Terrapin attack". This attack allows a MITM attacker to effect a
limited break of the integrity of the early encrypted SSH transport
protocol by sending extra messages prior to the commencement of
encryption, and deleting an equal number of consecutive messages
immediately after encryption starts.
Details can be found at https://terrapin-attack.com/
For the oldstable distribution (bullseye), this problem has been fixed
in version 1.0.19-3+deb11u1.
For the stable distribution (bookworm), this problem has been fixed in
version 1.0.20-1+deb12u1.
We recommend that you upgrade your phpseclib packages.
For the detailed security status of phpseclib please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/phpseclib
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmWg5PMACgkQEL6Jg/PV
nWS6iwgAgCFsThzoeNHG05PouaajhL6LvGsrj+cwed14VEnr0TGpChD6y2Z/deZX
HW86VXSHRZvqNTt7+UQvKUwrmvbNRZL3TQoTp9l+VKtn3wT/0Q6Zf1jsn4G+yffX
dredHf2pXgJh9poEy2DUTunVF+vpZdp9fS2QY8xp24kNbk8kk6itJeOGueWoFwrZ
p1B5q2hnQdFtM8mhbXDzViqbiu6zVZOmSXri1jShAKRDl0kpRQvfP1mKE+j5RMoJ
kBGFGuWnIXvxtwQEYDvobgKk5Ie0yzwqnD6m3WXMeS9x4Zi+HvV3hXvEu0UvvQXC
1z8VX31cFffkLLDFpO3cE9dQlyABBA==
=Rz3N
-----END PGP SIGNATURE-----
- [IT-SecNots] [SECURITY] [DSA 5599-1] phpseclib security update, Sebastien Delafond, 12.01.2024
Archiv bereitgestellt durch MHonArc 2.6.19+.