Bug 920385

Summary:	<net-ftp/proftpd-1.3.8b: terrapin vulnerability
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	normal	CC:	maintainer-needed
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	A3 [glsa?]
Package list:		Runtime testing required:	---
Bug Depends on:	934755
Bug Blocks:	920280

Description Sam James archtester

2023-12-20 15:08:46 UTC

CVE-2023-48795 (https://terrapin-attack.com/):

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, and PuTTY before 0.80; and there could be effects on Bitvise SSH through 9.31, AsyncSSH through 2.14.1, libssh through 0.10.5, and golang.org/x/crypto through 2023-12-17.

Comment 1 Larry the Git Cow gentoo-dev

2023-12-20 15:19:04 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9b38a63644a6643c8356ab3720c391f47446dda7

commit 9b38a63644a6643c8356ab3720c391f47446dda7
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-12-20 15:10:20 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-12-20 15:18:39 +0000

    net-ftp/proftpd: add 1.3.8b
    
    Bug: https://bugs.gentoo.org/920385
    Signed-off-by: Sam James <sam@gentoo.org>

 net-ftp/proftpd/Manifest              |   1 +
 net-ftp/proftpd/proftpd-1.3.8b.ebuild | 304 ++++++++++++++++++++++++++++++++++
 2 files changed, 305 insertions(+)

Comment 2 Larry the Git Cow gentoo-dev

2024-08-15 08:17:01 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1e6f9b09158fc94649052a6c93e250348bf63624

commit 1e6f9b09158fc94649052a6c93e250348bf63624
Author:     Hans de Graaff <graaff@gentoo.org>
AuthorDate: 2024-08-15 08:15:49 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2024-08-15 08:16:40 +0000

    net-ftp/proftpd: drop 1.3.8-r1
    
    Bug: https://bugs.gentoo.org/920385
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 net-ftp/proftpd/Manifest                |   1 -
 net-ftp/proftpd/proftpd-1.3.8-r1.ebuild | 275 --------------------------------
 2 files changed, 276 deletions(-)