Re: FreeBSD Security Advisory FreeBSD-SA-16:33.openssh

2016-11-06 Thread Dag-Erling Smørgrav
Xin LI writes: > We will investigate if the statement is true and will issue patches > for earlier FreeBSD releases, if they are confirmed to be affected. Hoping to make your life a little easier: $ git clone https://github.com/dag-erling/kexkill $ cd kexkill $ ./autogen.sh && ./configure && mak

Re: FreeBSD Security Advisory FreeBSD-SA-16:33.openssh

2016-11-04 Thread Xin LI
The issue was originally reported to us as affecting OpenSSH 6.8+ (reference: RedHat bugtracker https://bugzilla.redhat.com/show_bug.cgi?id=1384860), and therefore 9.3, 10.1 and 10.2 were not believed to be affected, so the "Affects: All supported versions of FreeBSD" was a mistake in the original

Re: FreeBSD Security Advisory FreeBSD-SA-16:33.openssh

2016-11-04 Thread Vladimir Terziev
Hi, if you look at the advisory, it states "Affects:All supported versions of FreeBSD.", while in the "Corrected" section 10.1 & 10.2 are missing. They are still supported, so the fix for them must be developed or they must be listed as not affected, if that's the case. Regards, Vlad

Re: FreeBSD Security Advisory FreeBSD-SA-16:33.openssh

2016-11-04 Thread Gregory Orange
On 04/11/16 16:39, Kubilay Kocak wrote: Security advisories should state explicitly when otherwise supported versions are not vulnerable. It's surprising this isn't already the case. I disagree. If none of the version I have installed are listed, I don't read the rest of the advisory. Time saved

Re: FreeBSD Security Advisory FreeBSD-SA-16:33.openssh

2016-11-04 Thread Kubilay Kocak
On 3/11/2016 9:36 PM, Matthew Seaman wrote: > On 2016/11/03 09:41, Kimmo Paasiala wrote: >> Both 10.1 and 10.2 are going to be unsupported by the end of this >> year, that's probably the reason the fix was not included in them. >> >> https://www.freebsd.org/security/#sup >> > > Yes, but 10.1 an

Re: FreeBSD Security Advisory FreeBSD-SA-16:33.openssh

2016-11-03 Thread Matthew Seaman
On 2016/11/03 09:41, Kimmo Paasiala wrote: > Both 10.1 and 10.2 are going to be unsupported by the end of this > year, that's probably the reason the fix was not included in them. > > https://www.freebsd.org/security/#sup > Yes, but 10.1 and 10.2 are still supported for the next two months. That

Re: FreeBSD Security Advisory FreeBSD-SA-16:33.openssh

2016-11-03 Thread Kimmo Paasiala
Both 10.1 and 10.2 are going to be unsupported by the end of this year, that's probably the reason the fix was not included in them. https://www.freebsd.org/security/#sup -Kimmo On Wed, Nov 2, 2016 at 3:57 PM, Martin Simmons wrote: >> On Wed, 2 Nov 2016 07:55:33 + (UTC), FreeBSD Securi

Re: FreeBSD Security Advisory FreeBSD-SA-16:33.openssh

2016-11-02 Thread Martin Simmons
> On Wed, 2 Nov 2016 07:55:33 + (UTC), FreeBSD Security Advisories > said: > > = > FreeBSD-SA-16:33.opensshSecurity Advisory >

FreeBSD Security Advisory FreeBSD-SA-16:33.openssh

2016-11-02 Thread FreeBSD Security Advisories
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 = FreeBSD-SA-16:33.opensshSecurity Advisory The FreeBSD Project Topic: