Bug#907124: stretch-pu: package dropbear/2016.74-5

[Adam D. Barratt]

Control: tags -1 + confirmed

On 2018-08-24 01:45, Guilhem Moulin wrote:

CVE-2018-15599 was recently published for dropbear:

    The recv_msg_userauth_request function in svr-auth.c in Dropbear

through 2018.76 is prone to a user enumeration vulnerability because

    username validity affects how fields in SSH_MSG_USERAUTH messages
    are handled, a similar issue to CVE-2018-15473 in an unrelated
    codebase.

However the Security Team didn't issue a DSA [0], and suggested [1] to
instead fix that via stretch-pu.  I enclosed a debdiff against
dropbear_2016.74-5.dsc.

+dropbear (2016.74-5+deb9u1) stable; urgency=medium

Please make the distribution "stretch", and feel free to upload.

Regards,

Adam