• [SECURITY] [DSA 5600-1] php-phpseclib security update

    From Sebastien Delafond@21:1/5 to All on Fri Jan 12 08:20:01 2024
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-5600-1 security@debian.org https://www.debian.org/security/ Sebastien Delafond January 12, 2024 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : php-phpseclib
    CVE ID : CVE-2023-48795

    Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the
    SSH protocol is prone to a prefix truncation attack, known as the
    "Terrapin attack". This attack allows a MITM attacker to effect a
    limited break of the integrity of the early encrypted SSH transport
    protocol by sending extra messages prior to the commencement of
    encryption, and deleting an equal number of consecutive messages
    immediately after encryption starts.

    Details can be found at https://terrapin-attack.com/

    For the oldstable distribution (bullseye), this problem has been fixed
    in version 2.0.30-2+deb11u1.

    For the stable distribution (bookworm), this problem has been fixed in
    version 2.0.42-1+deb12u1.

    We recommend that you upgrade your php-phpseclib packages.

    For the detailed security status of php-phpseclib please refer to
    its security tracker page at: https://security-tracker.debian.org/tracker/php-phpseclib

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

    iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmWg5P4ACgkQEL6Jg/PV nWTO8Qf+MjlqXFJ0p865PgV30sQmWeJmc8UiX/lOO9ayLUZ13Dj4z74H40XxAz0M rHDnpfs3hvtgTkdRkE+k2FvrMgau+EpN1eGwgrHURHN/Kdz9Z6YLQX/T8LZq97SZ VVu/X/+xkiZng0J+UXZx5BWQFf/vGz5vLiPA3JUSgS3KjwOYiZKIaSf+/7SF48he QTucpa7nC/7ew4dgLLNTa9PQWK8C616cJ6iZZaowi8k3QmUQGkyhuXS0EUHHRkxq EEf7HccwpwYbPAAkh5cIckEoXEC2gUkl2UmpzCFNdJl/xqz02xOfcgoDxM/1bYy2 Bn3cNLe681fmEd7ShPdNTYtqz6YvwQ==
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)