Filezilla project released a bugfix version including a Logjam workaround: "Reject Diffie-Hellman Groups smaller than 1024 bits when using FTP over TLS to protect against the Logjam attack" On the security-stabling side, this is based on a recent release (3.11 is 3 days old), and requires >=x11-libs/wxGTK-3.0.2.0-r1 (no wxGTK/3.0 has stable keywords at the moment). Still I suppose it is better to also fix this vulnerability on the client side Anyway if you want to start a stable request, 3.11.0.1 is in tree and works fine in my (limited and not including FT over TLS) testing
Ping.
If I using stable net-ftp/filezilla-3.7.3 from tree on the client side and openssh-6.9p1-1 on the server side (up-to-date arch-linux-arm on armv7), give me this in the logs on server side: Jul 17 19:19:12 CubieTruck sshd[621]: error: Hm, kex protocol error: type 30 seq 1 [preauth] ... and no login for sftp. I updated to net-ftp/filezilla-3.12.0.2 and login again is possible. The required x11-libs/wxGTK-3.0.2.0-r1 is stable for amd64 and x86.
Ah yes, looks like some progress was made in bug #547680 for =wxGTK-3.0.2.0-r1 We still need ppc stabling first, though
net-ftp/filezilla-3.12.0.2 is good to go for stabling (now that deps are OK) and has been in tree for some time, so let's stable this one (even as a "normal" stabling request) Arches, please test and mark stable =net-ftp/filezilla-3.12.0.2, thanks!
amd64 stable
x86 stable
ppc stable. Maintainer(s), please cleanup. Security, please vote.
Vulnerable version removed from tree: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=df609bc3c5ea18d7baeb2e086bf792f51480f6ae
Arches and Maintainer(s), Thank you for your work. Security Please Vote. GLSA Vote: No
GLSA Vote: No
