-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  openssh (SSA:2016-219-03)

New openssh packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,
14.2, and -current to fix security issues.


Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/openssh-7.3p1-i586-1_slack14.2.txz:  Upgraded.
  This is primarily a bugfix release, and also addresses security issues.
  sshd(8): Mitigate a potential denial-of-service attack against the system's
  crypt(3) function via sshd(8).
  sshd(8): Mitigate timing differences in password authentication that could
  be used to discern valid from invalid account names when long passwords were
  sent and particular password hashing algorithms are in use on the server.
  ssh(1), sshd(8): Fix observable timing weakness in the CBC padding oracle
  countermeasures.
  ssh(1), sshd(8): Improve operation ordering of MAC verification for
  Encrypt-then-MAC (EtM) mode transport MAC algorithms to verify the MAC
  before decrypting any ciphertext.
  sshd(8): (portable only) Ignore PAM environment vars when UseLogin=yes.
  For more information, see:
    https://www.openssh.com/txt/release-7.3
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6210
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8325
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(https://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on https://slackware.com for
additional mirror sites near you.

Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/openssh-7.3p1-i486-1_slack13.0.txz

Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/openssh-7.3p1-x86_64-1_slack13.0.txz

Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/openssh-7.3p1-i486-1_slack13.1.txz

Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/openssh-7.3p1-x86_64-1_slack13.1.txz

Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/openssh-7.3p1-i486-1_slack13.37.txz

Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/openssh-7.3p1-x86_64-1_slack13.37.txz

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/openssh-7.3p1-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/openssh-7.3p1-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/openssh-7.3p1-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/openssh-7.3p1-x86_64-1_slack14.1.txz

Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openssh-7.3p1-i586-1_slack14.2.txz

Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openssh-7.3p1-x86_64-1_slack14.2.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssh-7.3p1-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/openssh-7.3p1-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 13.0 package:
926a45f63599a8f7d559039220f2773c  openssh-7.3p1-i486-1_slack13.0.txz

Slackware x86_64 13.0 package:
2f18a3adf8ed54e59ac0c0740b138a67  openssh-7.3p1-x86_64-1_slack13.0.txz

Slackware 13.1 package:
7f5e48238b26237b9c2542a3d34847b6  openssh-7.3p1-i486-1_slack13.1.txz

Slackware x86_64 13.1 package:
e277d7c7865fd46bc48ac128849d6426  openssh-7.3p1-x86_64-1_slack13.1.txz

Slackware 13.37 package:
17c49c75c5d2b6ad49e0d2352fd2e922  openssh-7.3p1-i486-1_slack13.37.txz

Slackware x86_64 13.37 package:
6305b5ce1ce3a4390a56c36eca6920cc  openssh-7.3p1-x86_64-1_slack13.37.txz

Slackware 14.0 package:
508dbde12ca36275d305ad1014f12066  openssh-7.3p1-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
699e2c1d8d7383ba2137e9ead9001be2  openssh-7.3p1-x86_64-1_slack14.0.txz

Slackware 14.1 package:
6a2a5dca4d9334c70239c20bfed92791  openssh-7.3p1-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
eb14e40f2c50beb19ccf1aaccbaf416d  openssh-7.3p1-x86_64-1_slack14.1.txz

Slackware 14.2 package:
624fbc40486642443292ffdaaffba640  openssh-7.3p1-i586-1_slack14.2.txz

Slackware x86_64 14.2 package:
c0e4d51dfb3722aa69e008389f4f089d  openssh-7.3p1-x86_64-1_slack14.2.txz

Slackware -current package:
e9109896f7640f872e3695603579954f  n/openssh-7.3p1-i586-1.txz

Slackware x86_64 -current package:
bcf65b51088b5b7f1dc55bab1ef63684  n/openssh-7.3p1-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg openssh-7.3p1-i586-1_slack14.2.txz

Next, restart the sshd daemon:
# sh /etc/rc.d/rc.sshd restart


+-----+

Slackware Linux Security Team
https://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlemPasACgkQakRjwEAQIjMfYgCfT1gdAwLhlKdLOv6TPhSmIN0S
gLIAnjkJiZkhcop4hEQ/1aVbFxUXB8Tx
=6xDu
-----END PGP SIGNATURE-----