Commit 1d4b2381 authored by Thomas Gerbet's avatar Thomas Gerbet
Browse files

openssh, openssh_hpn, openssh_gssapi: 9.9p1 -> 9.9p2 

Fixes CVE-2025-26465 and CVE-2025-26466.
https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt

https://www.openssh.com/releasenotes.html#9.9p2
parent c0426387

pkgs/tools/networking/openssh/common.nix

+0 −4
Original line number Diff line number Diff line
@@ -50,10 +50,6 @@ stdenv.mkDerivation (finalAttrs: { 
  patches = [

    ./locale_archive.patch



    (fetchurl {

      url = "https://git.alpinelinux.org/aports/plain/main/openssh/gss-serv.c.patch?id=a7509603971ce2f3282486a43bb773b1b522af83";

      sha256 = "sha256-eFFOd4B2nccRZAQWwdBPBoKWjfEdKEVGJvKZAzLu3HU=";

    })

    # See discussion in https://github.com/NixOS/nixpkgs/pull/16966

    ./dont_create_privsep_path.patch

  ] ++ extraPatches;

pkgs/tools/networking/openssh/default.nix

+8 −8
Original line number Diff line number Diff line
@@ -11,11 +11,11 @@ in 
{

  openssh = common rec {

    pname = "openssh";

    version = "9.9p1";

    version = "9.9p2";



    src = fetchurl {

      url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";

      hash = "sha256-s0P7zb/4fxWxmG5uFdbU/Jp9NgZr5rf7UHCHuo+WbAI=";

      hash = "sha256-karbYD4IzChe3fll4RmdAlhfqU2ZTWyuW0Hhch4hVnM=";

    };



    extraPatches = [ ./ssh-keysign-8.5.patch ];
@@ -24,12 +24,12 @@ in 


  openssh_hpn = common rec {

    pname = "openssh-with-hpn";

    version = "9.9p1";

    version = "9.9p2";

    extraDesc = " with high performance networking patches";



    src = fetchurl {

      url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";

      hash = "sha256-s0P7zb/4fxWxmG5uFdbU/Jp9NgZr5rf7UHCHuo+WbAI=";

      hash = "sha256-karbYD4IzChe3fll4RmdAlhfqU2ZTWyuW0Hhch4hVnM=";

    };



    extraPatches =
@@ -67,12 +67,12 @@ in 


  openssh_gssapi = common rec {

    pname = "openssh-with-gssapi";

    version = "9.9p1";

    version = "9.9p2";

    extraDesc = " with GSSAPI support";



    src = fetchurl {

      url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";

      hash = "sha256-s0P7zb/4fxWxmG5uFdbU/Jp9NgZr5rf7UHCHuo+WbAI=";

      hash = "sha256-karbYD4IzChe3fll4RmdAlhfqU2ZTWyuW0Hhch4hVnM=";

    };



    extraPatches = [
@@ -80,8 +80,8 @@ in 


      (fetchpatch {

        name = "openssh-gssapi.patch";

        url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%25${version}-2/debian/patches/gssapi.patch";

        hash = "sha256-cQF5psMZpLWwVqK9CNi+Q8wHn6w6ffQUJRNI5jKGgD0=";

        url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%25${version}-1/debian/patches/gssapi.patch";

        hash = "sha256-JyOXA8Al8IFLdndJQ1LO+r4hJqtXjz1NHwOPiSAQkE8=";

      })

    ];