Debian Patches

Status for cockpit/287.1-0+deb12u3

Patch Description Author Forwarded Bugs Origin Last update
0001-ssh-Use-valid-host-name-in-test-sshbridge.patch [PATCH] ssh: Use valid host name in test-sshbridge
libssh 0.10.6 made host name parsing stricter. `some_host` is not a
valid general host name, and is rejected with the latest version.		 Martin Pitt <mpitt@redhat.com> no 2023-12-29
0002-pam-ssh-add-Fix-insecure-killing-of-session-ssh-agen.patch [PATCH] pam-ssh-add: Fix insecure killing of session ssh-agent [CVE-2024-6126]

Some distributions like Debian 12, or possibly some administrators
enable pam_env's deprecated `user_readenv` option [1]. The user session
can change the `$SSH_AGENT_PID`, so that it can pass an arbitrary pid to
`pam_sm_close_session()`. This is a local authenticated DoS.

Avoid this by storing the agent pid in a global variable. The
cockpit-session process stays around for the entire session time, so we
don't need to put the pid into the PAM data.

It can also happen that the user session's ssh-agent gets killed, and
some other process later on recycles the PID. Temporarily drop
privileges to the target user so that we at least don't kill anyone
else's process.

Add an integration test which checks that changing the env variable
works, pointing it to a different process doesn't kill that, and
ssh-agent (the original pid) is still cleaned up correctly. However, as
pam_so.env in Fedora crashes hard, skip the test there.

Many thanks to Paolo Perego <paolo.perego@suse.com> for discovering,
and Luna Dragon <luna.dragon@suse.com> for reporting this issue!

[1] https://man7.org/linux/man-pages/man8/pam_env.8.html

CVE-2024-6126
https://bugzilla.redhat.com/show_bug.cgi?id=2290859		 Martin Pitt <mpitt@redhat.com> no 2024-06-10

All known versions for source package 'cockpit'

Links