[ANNOUNCEMENT] Updated: OpenSSH-5.8p1-1

[ANNOUNCEMENT] Updated: OpenSSH-5.8p1-1

[Corinna Vinschen]

I've just updated the Cygwin version of OpenSSH to 5.8p1-1.

This is an upstream security and bugfix release.

The Cygwin release additionally contains a patch to the ssh-host-config
and ssh-user-config scripts which additionally asks to create the new
ECDSA key type.  The patch has not yet been applied to the upstream
repository.

The official release message for 5.8p1:

====================================================================
OpenSSH 5.8 has just been released. It will be available from the
mirrors listed at http://www.openssh.com/ shortly.

OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0
implementation and includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots or donated to the
project. More information on donations may be found at:
http://www.openssh.com/donations.html

Changes since OpenSSH 5.7
=========================

Security:

 * Fix vulnerability in legacy certificate signing introduced in
   OpenSSH-5.6 and found by Mateusz Kocielski.

   Legacy certificates signed by OpenSSH 5.6 or 5.7 included data from
   the stack in place of a random nonce field. The contents of the stack
   do not appear to contain private data at this point, but this cannot
   be stated with certainty for all platform, library and compiler
   combinations. In particular, there exists a risk that some bytes from
   the privileged CA key may be accidentally included.

   A full advisory for this issue is available at:
   http://www.openssh.com/txt/legacy-cert.adv

Portable OpenSSH Bugfixes:

 * Fix compilation failure when enableing SELinux support.

 * Do not attempt to call SELinux functions when SELinux is disabled.
   bz#1851

Checksums:
==========

 - SHA1 (openssh-5.8.tar.gz) = 205dece2c8b41c69b082eb65320d359987aae25b
 - SHA1 (openssh-5.8p1.tar.gz) = adebb2faa9aba2a3a3c8b401b2b19677ab53f0de

Reporting Bugs:
===============

- Please read http://www.openssh.com/report.html
  Security bugs should be reported directly to openssh@openssh.com

OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
Ben Lindstrom.
====================================================================

To update your installation, click on the "Install Cygwin now" link on
the http://cygwin.com/ web page.  This downloads setup.exe to your
system.  Then, run setup and answer all of the questions.

              *** CYGWIN-ANNOUNCE UNSUBSCRIBE INFO ***

If you want to unsubscribe from the cygwin-announce mailing list, look
at the "List-Unsubscribe: " tag in the email header of this message.
Send email to the address specified there.  It will be in the format:

cygwin-announce-unsubscribe-you=3D3Dyourdomain.com@cygwin.com

If you need more information on unsubscribing, start reading here:

http://sourceware.org/lists.html#unsubscribe-simple

Please read *all* of the information on unsubscribing that is available
starting at this URL.

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Project Co-Leader          cygwin AT cygwin DOT com
Red Hat

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANNOUNCEMENT] Updated: OpenSSH-5.8p1-1

[Hans Horn]

Corinna,

Last week I updated openssh to 5.7p1-1, just to realize that I cannot 
connect anymore. Reverting to 5.6p1-2 solved the issue.

Saturday I updated to 5.8p1-1 finding the same failure to connect as 
with 5.7p1-1.
Unfortunately 5.6p1-2 is not among the setup choices anymore.

How can I get openssh 5.6p1-2 back?

Thx.,
H.

  On 2/4/2011 4:27 AM, Corinna Vinschen wrote:
> I've just updated the Cygwin version of OpenSSH to 5.8p1-1.
>
> This is an upstream security and bugfix release.
>
> The Cygwin release additionally contains a patch to the ssh-host-config
> and ssh-user-config scripts which additionally asks to create the new
> ECDSA key type.  The patch has not yet been applied to the upstream
> repository.
>
> The official release message for 5.8p1:
>
> ====================================================================
> OpenSSH 5.8 has just been released. It will be available from the
> mirrors listed at http://www.openssh.com/ shortly.
>
> OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0
> implementation and includes sftp client and server support.
>
> Once again, we would like to thank the OpenSSH community for their
> continued support of the project, especially those who contributed
> code or patches, reported bugs, tested snapshots or donated to the
> project. More information on donations may be found at:
> http://www.openssh.com/donations.html
>
> Changes since OpenSSH 5.7
> =========================
>
> Security:
>
>   * Fix vulnerability in legacy certificate signing introduced in
>     OpenSSH-5.6 and found by Mateusz Kocielski.
>
>     Legacy certificates signed by OpenSSH 5.6 or 5.7 included data from
>     the stack in place of a random nonce field. The contents of the stack
>     do not appear to contain private data at this point, but this cannot
>     be stated with certainty for all platform, library and compiler
>     combinations. In particular, there exists a risk that some bytes from
>     the privileged CA key may be accidentally included.
>
>     A full advisory for this issue is available at:
>     http://www.openssh.com/txt/legacy-cert.adv
>
> Portable OpenSSH Bugfixes:
>
>   * Fix compilation failure when enableing SELinux support.
>
>   * Do not attempt to call SELinux functions when SELinux is disabled.
>     bz#1851
>
> Checksums:
> ==========
>
>   - SHA1 (openssh-5.8.tar.gz) = 205dece2c8b41c69b082eb65320d359987aae25b
>   - SHA1 (openssh-5.8p1.tar.gz) = adebb2faa9aba2a3a3c8b401b2b19677ab53f0de
>
> Reporting Bugs:
> ===============
>
> - Please read http://www.openssh.com/report.html
>    Security bugs should be reported directly to openssh@openssh.com
>
> OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
> Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
> Ben Lindstrom.
> ====================================================================
>
> To update your installation, click on the "Install Cygwin now" link on
> the http://cygwin.com/ web page.  This downloads setup.exe to your
> system.  Then, run setup and answer all of the questions.
>
>                *** CYGWIN-ANNOUNCE UNSUBSCRIBE INFO ***
>
> If you want to unsubscribe from the cygwin-announce mailing list, look
> at the "List-Unsubscribe: " tag in the email header of this message.
> Send email to the address specified there.  It will be in the format:
>
> cygwin-announce-unsubscribe-you=3D3Dyourdomain.com@cygwin.com
>
> If you need more information on unsubscribing, start reading here:
>
> http://sourceware.org/lists.html#unsubscribe-simple
>
> Please read *all* of the information on unsubscribing that is available
> starting at this URL.
>



--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANNOUNCEMENT] Updated: OpenSSH-5.8p1-1

[Larry Hall (Cygwin)]

On 2/8/2011 3:54 PM, Hans Horn wrote:
> Corinna,
>
> Last week I updated openssh to 5.7p1-1, just to realize that I cannot connect
> anymore. Reverting to 5.6p1-2 solved the issue.
>
> Saturday I updated to 5.8p1-1 finding the same failure to connect as with
> 5.7p1-1. Unfortunately 5.6p1-2 is not among the setup choices anymore.
>
> How can I get openssh 5.6p1-2 back?

If you're only interested in how to get back to 5.6, you could try the
"Cygwin Time Machine".  Google for it.  You might also have it locally
in your download directory.  You could point 'setup.exe' there and install
from it instead of the network mirror.

-- 
Larry

_____________________________________________________________________

A: Yes.
> Q: Are you sure?
>> A: Because it reverses the logical flow of conversation.
>>> Q: Why is top posting annoying in email?

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANNOUNCEMENT] Updated: OpenSSH-5.8p1-1

[Corinna Vinschen]

On Feb  8 16:02, Larry Hall (Cygwin) wrote:
> On 2/8/2011 3:54 PM, Hans Horn wrote:
> >Corinna,
> >
> >Last week I updated openssh to 5.7p1-1, just to realize that I cannot connect
> >anymore. Reverting to 5.6p1-2 solved the issue.
> >
> >Saturday I updated to 5.8p1-1 finding the same failure to connect as with
> >5.7p1-1. Unfortunately 5.6p1-2 is not among the setup choices anymore.
> >
> >How can I get openssh 5.6p1-2 back?
> 
> If you're only interested in how to get back to 5.6, you could try the
> "Cygwin Time Machine".  Google for it.  You might also have it locally
> in your download directory.  You could point 'setup.exe' there and install
> from it instead of the network mirror.

But, of course, it would be more helpful in the long run if you would
try to track down the problem.  I'm using 5.7p1 and 5.8p1 without any
problems, as client as well as server.  If you go back to 5.6p1, you
switch off yourself from further development.  If there's some bug or
incompatibility in your setup, you will never find it.  If there's a bug
in OpenSSH, it might never be found either.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Project Co-Leader          cygwin AT cygwin DOT com
Red Hat

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANNOUNCEMENT] Updated: OpenSSH-5.8p1-1

[Hans Horn]

On 2/8/2011 1:06 PM, Corinna Vinschen wrote:
> On Feb  8 16:02, Larry Hall (Cygwin) wrote:
>> On 2/8/2011 3:54 PM, Hans Horn wrote:
>>> Corinna,
>>>
>>> Last week I updated openssh to 5.7p1-1, just to realize that I cannot connect
>>> anymore. Reverting to 5.6p1-2 solved the issue.
>>>
>>> Saturday I updated to 5.8p1-1 finding the same failure to connect as with
>>> 5.7p1-1. Unfortunately 5.6p1-2 is not among the setup choices anymore.
>>>
>>> How can I get openssh 5.6p1-2 back?
>>
>> If you're only interested in how to get back to 5.6, you could try the
>> "Cygwin Time Machine".  Google for it.  You might also have it locally
>> in your download directory.  You could point 'setup.exe' there and install
>> from it instead of the network mirror.
>
> But, of course, it would be more helpful in the long run if you would
> try to track down the problem.  I'm using 5.7p1 and 5.8p1 without any
> problems, as client as well as server.  If you go back to 5.6p1, you
> switch off yourself from further development.  If there's some bug or
> incompatibility in your setup, you will never find it.  If there's a bug
> in OpenSSH, it might never be found either.
>
> Corinna

Trying some of the more recent revisions listed on the "Cygwin Time 
Machine".
e.g. ftp://www.fruitbat.org/pub/cygwin/circa/2011/01/11/194023

All give me "Unable to get ...setup.bz2.sig" and
then "Unable to get ...setup.ini.sig".

What gives?
H.



--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANNOUNCEMENT] Updated: OpenSSH-5.8p1-1

[Larry Hall (Cygwin)]

On 2/8/2011 4:42 PM, Hans Horn wrote:
> On 2/8/2011 1:06 PM, Corinna Vinschen wrote:
>> On Feb 8 16:02, Larry Hall (Cygwin) wrote:
>>> On 2/8/2011 3:54 PM, Hans Horn wrote:
>>>> Corinna,
>>>>
>>>> Last week I updated openssh to 5.7p1-1, just to realize that I cannot connect
>>>> anymore. Reverting to 5.6p1-2 solved the issue.
>>>>
>>>> Saturday I updated to 5.8p1-1 finding the same failure to connect as with
>>>> 5.7p1-1. Unfortunately 5.6p1-2 is not among the setup choices anymore.
>>>>
>>>> How can I get openssh 5.6p1-2 back?
>>>
>>> If you're only interested in how to get back to 5.6, you could try the
>>> "Cygwin Time Machine". Google for it. You might also have it locally
>>> in your download directory. You could point 'setup.exe' there and install
>>> from it instead of the network mirror.
>>
>> But, of course, it would be more helpful in the long run if you would
>> try to track down the problem. I'm using 5.7p1 and 5.8p1 without any
>> problems, as client as well as server. If you go back to 5.6p1, you
>> switch off yourself from further development. If there's some bug or
>> incompatibility in your setup, you will never find it. If there's a bug
>> in OpenSSH, it might never be found either.
>>
>> Corinna
>
> Trying some of the more recent revisions listed on the "Cygwin Time Machine".
> e.g. ftp://www.fruitbat.org/pub/cygwin/circa/2011/01/11/194023
>
> All give me "Unable to get ...setup.bz2.sig" and
> then "Unable to get ...setup.ini.sig".
>
> What gives?

That's a question for the Cygwin Time Machine site.  Despite the fact
that it uses the name "Cygwin", that site and service is not supported
by this list.

-- 
Larry

_____________________________________________________________________

A: Yes.
> Q: Are you sure?
>> A: Because it reverses the logical flow of conversation.
>>> Q: Why is top posting annoying in email?

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANNOUNCEMENT] Updated: OpenSSH-5.8p1-1

[Cyrille Lefevre]

Le 08/02/2011 22:42, Hans Horn a écrit :
> Trying some of the more recent revisions listed on the "Cygwin Time
> Machine".
> e.g. ftp://www.fruitbat.org/pub/cygwin/circa/2011/01/11/194023
>
> All give me "Unable to get ...setup.bz2.sig" and
> then "Unable to get ...setup.ini.sig".
>
> What gives?

does setup -K http://mirrors.kernel.org/sourceware/cygwin/setup.bz2.sig 
help ?

Regards,

Cyrille Lefevre
-- 
mailto:Cyrille.Lefevre-lists@laposte.net



--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANNOUNCEMENT] Updated: OpenSSH-5.8p1-1

[Hans Horn]

On 2/8/2011 3:32 PM, Cyrille Lefevre wrote:
>
> Le 08/02/2011 22:42, Hans Horn a écrit :
>> Trying some of the more recent revisions listed on the "Cygwin Time
>> Machine".
>> e.g. ftp://www.fruitbat.org/pub/cygwin/circa/2011/01/11/194023
>>
>> All give me "Unable to get ...setup.bz2.sig" and
>> then "Unable to get ...setup.ini.sig".
>>
>> What gives?
>
> does setup -K http://mirrors.kernel.org/sourceware/cygwin/setup.bz2.sig
> help ?
>
> Regards,
>
> Cyrille Lefevre

Nope - I get exactly the same behavior.


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANNOUNCEMENT] Updated: OpenSSH-5.8p1-1

[Hans Horn]

On 2/8/2011 3:58 PM, Hans Horn wrote:
> On 2/8/2011 3:32 PM, Cyrille Lefevre wrote:
>>
>> Le 08/02/2011 22:42, Hans Horn a écrit :
>>> Trying some of the more recent revisions listed on the "Cygwin Time
>>> Machine".
>>> e.g. ftp://www.fruitbat.org/pub/cygwin/circa/2011/01/11/194023
>>>
>>> All give me "Unable to get ...setup.bz2.sig" and
>>> then "Unable to get ...setup.ini.sig".
>>>
>>> What gives?
>>
>> does setup -K http://mirrors.kernel.org/sourceware/cygwin/setup.bz2.sig
>> help ?
>>
>> Regards,
>>
>> Cyrille Lefevre
>
> Nope - I get exactly the same behavior.


Folks,

I had to summon the "Cygwin Time Machine" via setup with the -X flag, 
which suppresses the disable the lookup of the signature file (according 
to http://www.fruitbat.org/Cygwin/index.html).

So I finally got a hold of openssh 5.6p1-2, which solved my ssh 
connection issues.

thx.,
H.



--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple