Page MenuHomeFreeBSD

shells/rssh: Apply fixes for basename(3) handling and some security issues
ClosedPublic

Authored by kai on Mar 5 2019, 10:34 PM.
Tags
None
Referenced Files
F103449667: D19474.diff
Mon, Nov 25, 4:33 AM
Unknown Object (File)
Sun, Nov 17, 11:55 AM
Unknown Object (File)
Thu, Nov 14, 6:28 PM
Unknown Object (File)
Oct 4 2024, 10:51 AM
Unknown Object (File)
Oct 2 2024, 4:35 AM
Unknown Object (File)
Sep 30 2024, 3:25 PM
Unknown Object (File)
Sep 21 2024, 3:20 PM
Unknown Object (File)
Sep 21 2024, 3:20 PM
Subscribers
None

Details

Summary
  • Apply fixes for the handling of basename(3) that has been changed to be POSIX compliant in r308264. Without those fixes rssh crashes always with signal 11 upon invocation in FreeBSD 12 and later. [1] [2]
  • Also add patches [3] for recently discovered security issues:
    • CVE-2019-1000018
    • CVE-2019-3463
    • CVE-2019-3464

PR: 235121
Submitted by: topical@gmx.net (former version), Jason Harris [2]
Security: d193aa9f-3f8c-11e9-9a24-6805ca0b38e8
MFH: 2019Q1
Obtained from: Debian [3]
Approved by: (one of the mentors)

Test Plan
  • poudriere (11.2-, 12.0-RELEASE, 13.0-CURRENT@r344648 amd64 + i386) -> OK
  • portlint -> Skipped (only bumped PORTREVISION and added new patches)
  • Runtime tests -> OK

shells/rssh has been officially abandoned by upstream and even the maintainer of the Debian package will pull the plug for the next stable release of Debian. So I think it would make sense to deprecate the port as well. I'm still waiting for some feedback of the maintainer.

Diff Detail

Repository
rP FreeBSD ports repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable