Change:
, CVSSv3=7.0 (nixos-21.05) CVSSv3=5.3 (nixos-21.05) sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. Scanned versions: nixos-21.05: . Cc Cc

Discussion:
openssh_gssapi = common rec { pname = "openssh-with-gssapi"; <del> version = "8.4p1"; </del> <ins> version = "9.0p1"; </ins> extraDesc = " with GSSAPI support"; src = fetchurl { url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz"; <del> sha256 = "091b3pxdlj47scxx6kkf4agkx8c8sdacdxx8m1dw1cby80pd40as"; </del> <ins> sha256 = "12m2f9czvgmi7akp7xah6y7mrrpi280a3ksk47iwr7hy2q1475q3"; </ins> }; extraPatches = [ <del> ./ssh-keysign-8.4.patch # See https://github.com/openssh/openssh-portable/pull/206 ./ssh-copy-id-fix-eof.patch </del> <ins> ./ssh-keysign-8.5.patch </ins> (fetchpatch { name = "openssh-gssapi.patch"; <del> url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%25${version}-2/debian/patches/gssapi.patch"; sha256 = "1z1ckzimlkm1dmr9f5fqjnjg28gsqcwx6xka0klak857548d2lp2"; </del> <ins> url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%25${version}-1/debian/patches/gssapi.patch"; sha256 = "sha256-VG7+2dfu09nvHWuSAB6sLGMmjRCDCysl/9FR1WSF21k="; </ins> }) ]; extraNativeBuildInputs = [ autoreconfHook ]; <del> extraMeta.knownVulnerabilities = [ "CVE-2021-28041" "CVE-2021-41617" ]; </del> }; }

<del> diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id index 392f64f..a769077 100644 --- a/contrib/ssh-copy-id +++ b/contrib/ssh-copy-id @@ -247,7 +247,7 @@ installkeys_sh() { #    the -z `tail ...` checks for a trailing newline. The echo adds one if was missing #    the cat adds the keys we're getting via STDIN #    and if available restorecon is used to restore the SELinux context -  INSTALLKEYS_SH=$(tr 'tn' ' ' <<-EOF) +  INSTALLKEYS_SH=$(tr 'tn' ' ' <<-EOF cd; umask 077; mkdir -p $(dirname "${AUTH_KEY_FILE}") && @@ -258,6 +258,7 @@ installkeys_sh() { restorecon -F .ssh ${AUTH_KEY_FILE}; fi EOF +  ) # to defend against quirky remote shells: use 'exec sh -c' to get POSIX; printf "exec sh -c '%s'" "${INSTALLKEYS_SH}" </del>

<del> diff --git a/pathnames.h b/pathnames.h index cb44caa4..354fdf05 100644 --- a/pathnames.h +++ b/pathnames.h @@ -124,7 +124,7 @@ /* Location of ssh-keysign for hostbased authentication */ #ifndef _PATH_SSH_KEY_SIGN -#define _PATH_SSH_KEY_SIGN		"/usr/libexec/ssh-keysign" +#define _PATH_SSH_KEY_SIGN		"ssh-keysign" #endif /* Location of ssh-pkcs11-helper to support keys in tokens */ diff --git a/sshconnect2.c b/sshconnect2.c index dffee90b..e9a86e59 100644 --- a/sshconnect2.c +++ b/sshconnect2.c @@ -1879,7 +1879,7 @@ ssh_keysign(struct ssh *ssh, struct sshkey *key, u_char **sigp, size_t *lenp, closefrom(sock + 1); debug3("%s: [child] pid=%ld, exec %s", __func__, (long)getpid(), _PATH_SSH_KEY_SIGN); -		execl(_PATH_SSH_KEY_SIGN, _PATH_SSH_KEY_SIGN, (char *)NULL); +		execlp(_PATH_SSH_KEY_SIGN, _PATH_SSH_KEY_SIGN, (char *)NULL); fatal("%s: exec(%s): %s", __func__, _PATH_SSH_KEY_SIGN, strerror(errno)); } -- 2.22.0 </del>