From 969e14a6849a4ec9030d09059e8d81dce0ff0c49 Mon Sep 17 00:00:00 2001 From: sana kazi Date: Thu, 30 Sep 2021 13:46:30 +0530 Subject: openssh: Fix CVE-2021-28041 Added patch to fix CVE-2021-28041. Link: http://archive.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_8.2p1-4ubuntu0.3.debian.tar.xz Signed-off-by: Sana Kazi Signed-off-by: Sana Kazi Signed-off-by: Steve Sakoman --- .../openssh/openssh/CVE-2021-28041.patch | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2021-28041.patch (limited to 'meta/recipes-connectivity/openssh/openssh/CVE-2021-28041.patch') diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2021-28041.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2021-28041.patch new file mode 100644 index 0000000000..9fd7e932d1 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2021-28041.patch @@ -0,0 +1,20 @@ +Description: fix double-free memory corruption in ssh-agent +Author: Marc Deslauriers +Origin: minimal fix for https://github.com/openssh/openssh-portable/commit/e04fd6dde16de1cdc5a4d9946397ff60d96568db + +Signed-off-by: Sana Kazi + +CVE: CVE-2021-28041 +Upstream-Status: Backport [http://archive.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_8.2p1-4ubuntu0.3.debian.tar.xz] +Comment: No change in any hunk + +--- a/ssh-agent.c ++++ b/ssh-agent.c +@@ -496,6 +496,7 @@ process_add_identity(SocketEntry *e) + goto err; + } + free(ext_name); ++ ext_name = NULL; + break; + default: + error("%s: Unknown constraint %d", __func__, ctype); -- cgit 1.2.3-korg