From: Pawan Badganchi Date: Mon, 13 Jun 2022 13:48:15 +0000 (+0530) Subject: openssh: Whitelist CVE-2021-36368 X-Git-Tag: 2020-04.18-dunfell~50 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=179b862e97d95ef57f8ee847e54a78b5f3f52ee7;p=thirdparty%2Fopenembedded%2Fopenembedded-core.git openssh: Whitelist CVE-2021-36368 As per debian, the issue is fixed by a feature called "agent restriction" in openssh 8.9. Urgency is unimportant as per debian, Hence this CVE is whitelisting. Link: https://security-tracker.debian.org/tracker/CVE-2021-36368 https://bugzilla.mindrot.org/show_bug.cgi?id=3316#c2 https://docs.ssh-mitm.at/trivialauth.html Signed-off-by: Pawan Badganchi Signed-off-by: Steve Sakoman --- diff --git a/meta/recipes-connectivity/openssh/openssh_8.2p1.bb b/meta/recipes-connectivity/openssh/openssh_8.2p1.bb index ddc9ed0b323..eaec26cac04 100644 --- a/meta/recipes-connectivity/openssh/openssh_8.2p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_8.2p1.bb @@ -60,6 +60,13 @@ CVE_CHECK_WHITELIST += "CVE-2008-3844" # https://ubuntu.com/security/CVE-2016-20012 CVE_CHECK_WHITELIST += "CVE-2016-20012" +# As per debian, the issue is fixed by a feature called "agent restriction" in openssh 8.9 +# Urgency is unimportant as per debian, Hence this CVE is whitelisting. +# https://security-tracker.debian.org/tracker/CVE-2021-36368 +# https://bugzilla.mindrot.org/show_bug.cgi?id=3316#c2 +# https://docs.ssh-mitm.at/trivialauth.html +CVE_CHECK_WHITELIST += "CVE-2021-36368" + PAM_SRC_URI = "file://sshd" inherit manpages useradd update-rc.d update-alternatives systemd