it-securitynotifies AT lists.piratenpartei.de
Betreff: Sicherheitsankündigungen
Listenarchiv
- From: Sebastien Delafond <seb AT debian.org>
- To: debian-security-announce AT lists.debian.org
- Subject: [IT-SecNots] [SECURITY] [DSA 5601-1] php-phpseclib3 security update
- Date: Fri, 12 Jan 2024 07:13:09 +0000
- List-archive: https://lists.debian.org/msgid-search/E1rOBj3-00BEiI-2r AT seger.debian.org
- List-id: <debian-security-announce.lists.debian.org>
- List-url: <http://lists.debian.org/debian-security-announce/>
- Old-dkim-signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.seger; h=Date:Message-Id:Subject:To:From:Reply-To:Cc:MIME-Version: Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description: In-Reply-To:References; bh=QTj1Ih8Q/VUejLUzGLNBtr2oQZ+Xw8hlCzLmLsKIJYw=; b=Xl cEhoL3+qSjSiwTe2eOQXZJqTqbSrINwgEZlz6NS9WujDfCgRPkng5+NMOeJqaEbtU/GAHy4T+Zce7 xjg6SnINWLAj8JMF1AvbH0e3B6qx8kyV0jFFHz6wkueu730T2hpcNQ6SDK568wCV2EGR/QpbXEmNY mS1+J7U1FvHRUkEq/e2mADD3eoAAKHJ9+RKZxsO7bXo3cDG4qS8JEdTXR5pr0WWoZXb2Whd3aJdVW cib5E7LfocaidbJJ2r7PDs/0BSKzkFJlcQKu4DHjHKPKGhidkzvXUYkh9Mh4tBa3Sv+ipFMKZFTJm kaF7RqcBliOp1Y+2vQ84oQkW4jH1+Q1w==;
- Old-return-path: <seb AT seger.debian.org>
- Priority: urgent
- Resent-date: Fri, 12 Jan 2024 07:13:57 +0000 (UTC)
- Resent-from: debian-security-announce AT lists.debian.org
- Resent-message-id: <c8pSRu1lMjJ.A.tkC.1aOolB@bendel>
- Resent-sender: debian-security-announce-request AT lists.debian.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5601-1 security AT debian.org
https://www.debian.org/security/ Sebastien Delafond
January 12, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : php-phpseclib3
CVE ID : CVE-2023-48795
Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the
SSH protocol is prone to a prefix truncation attack, known as the
"Terrapin attack". This attack allows a MITM attacker to effect a
limited break of the integrity of the early encrypted SSH transport
protocol by sending extra messages prior to the commencement of
encryption, and deleting an equal number of consecutive messages
immediately after encryption starts.
Details can be found at https://terrapin-attack.com/
For the stable distribution (bookworm), this problem has been fixed in
version 3.0.19-1+deb12u2.
We recommend that you upgrade your php-phpseclib3 packages.
For the detailed security status of php-phpseclib3 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/php-phpseclib3
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmWg5QQACgkQEL6Jg/PV
nWRUKwf/QGg/4t/cvkkj4MAEJs5GLxmT/UpIUdhEMjVtpVZk6k6m9K/OK3/3EXuT
XYtNhIyByOiWpLt5kMBrG9I5tz6/ffErfiPYYJso7fWyAaWKopFp0qsYGe8FDq0a
VSKo51b+SHPDtMxCxahTdkegaSCpjaEFiWZNd0/h4ZvS3ZNuOFQXcPor+mTIHqJT
PkkpsMm9Qg7skmDrrlENLvDRgXn8HuJa0h2+vhNnSwfC/cTDKPICeOozB4qMWu4Q
YzlMSKC/mLJIVlqmVufQndnHLYlKLexusiCCckn/B/irOS5FRrOkXqfPmOtgpC9e
DLhP7y/CkMhwhR6Ty/oOR/62zhhZpg==
=/Vah
-----END PGP SIGNATURE-----
- [IT-SecNots] [SECURITY] [DSA 5601-1] php-phpseclib3 security update, Sebastien Delafond, 12.01.2024
Archiv bereitgestellt durch MHonArc 2.6.19+.