data/CVE/list

@@ -27499,7 +27499,6 @@ CVE-2016-10708 (sshd in OpenSSH before 7.4 allows remote attackers to cause a de
 	NOTE: https://anongit.mindrot.org/openssh.git/commit/?id=28652bca29046f62c7045e933e6b931de1d16737
 	NOTE: http://blog.swiecki.net/2018/01/fuzzing-tcp-servers.html
 	NOTE: Flaw is not crashing the whole sshd daemon, rather the privsep process
-	NOTE: patched in https://salsa.debian.org/santiago/openssh/tree/jessie
 CVE-2018-5954 (phpFreeChat 1.7 and earlier allows remote attackers to cause a denial ...)
 	NOT-FOR-US: phpFreeChat
 CVE-2018-5953 (The swiotlb_print_info function in lib/swiotlb.c in the Linux kernel ...)
@@ -48186,7 +48185,6 @@ CVE-2017-15906 (The process_open function in sftp-server.c in OpenSSH before 7.6
 	[jessie] - openssh <postponed> (Minor issue)
 	[wheezy] - openssh <no-dsa> (Minor issue)
 	NOTE: https://github.com/openbsd/src/commit/a6981567e8e215acc1ef690c8dbb30f2d9b00a19
-	NOTE: patched in https://salsa.debian.org/santiago/openssh/tree/jessie
 CVE-2017-15905
 	RESERVED
 CVE-2017-15904
@@ -85383,14 +85381,12 @@ CVE-2016-10012 (The shared memory manager (associated with pre-authentication ..
 	NOTE: Fixed in upstream 7.4: https://www.openssh.com/txt/release-7.4
 	NOTE: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/monitor.c.diff?r1=1.165&r2=1.166
 	NOTE: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/monitor.h.diff?r1=1.19&r2=1.20
-	NOTE: patched in https://salsa.debian.org/santiago/openssh/tree/jessie
 CVE-2016-10011 (authfile.c in sshd in OpenSSH before 7.4 does not properly consider ...)
 	- openssh 1:7.4p1-1 (low; bug #848716)
 	[jessie] - openssh <postponed> (Minor issue)
 	[wheezy] - openssh <no-dsa> (Minor issue)
 	NOTE: Fixed in upstream 7.4: https://www.openssh.com/txt/release-7.4
 	NOTE: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/authfile.c.diff?r1=1.121&r2=1.122
-	NOTE: patched in https://salsa.debian.org/santiago/openssh/tree/jessie
 CVE-2016-10010 (sshd in OpenSSH before 7.4, when privilege separation is not used, ...)
 	- openssh 1:7.4p1-1 (unimportant; bug #848715)
 	NOTE: Fixed in upstream 7.4: https://www.openssh.com/txt/release-7.4
@@ -85402,7 +85398,6 @@ CVE-2016-10009 (Untrusted search path vulnerability in ssh-agent.c in ssh-agent
 	[wheezy] - openssh <no-dsa> (Minor issue)
 	NOTE: Fixed in upstream 7.4: https://www.openssh.com/txt/release-7.4
 	NOTE: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/ssh-agent.c.diff?r1=1.214&r2=1.215
-	NOTE: patched in https://salsa.debian.org/santiago/openssh/tree/jessie
 CVE-2016-9998 (SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability ...)
 	{DLA-760-1}
 	- spip 3.1.4-2 (bug #848641)
@@ -104671,7 +104666,6 @@ CVE-2016-6515 (The auth_password function in auth-passwd.c in sshd in OpenSSH be
 	- openssh 1:7.3p1-1 (bug #833823)
 	[jessie] - openssh <postponed> (Minor issue; can be included in future DSA or via point release)
 	NOTE: Fixed by: https://anongit.mindrot.org/openssh.git/commit/?id=fcd135c9df440bcd2d5870405ad3311743d78d97
-	NOTE: patched in https://salsa.debian.org/santiago/openssh/tree/jessie
 CVE-2016-6514
 	RESERVED
 CVE-2016-6502
@@ -116356,7 +116350,6 @@ CVE-2016-3115 (Multiple CRLF injection vulnerabilities in session.c in sshd in .
 	NOTE: Portable OpenSSH 7.2p2 contains a fix for this vulnerability.
 	NOTE: http://www.openwall.com/lists/oss-security/2016/03/10/8
 	NOTE: Upstream fix: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c.diff?r1=1.281&r2=1.282&sortby=date&f=h
-	NOTE: patched in https://salsa.debian.org/santiago/openssh/tree/jessie
 CVE-2016-3134 (The netfilter subsystem in the Linux kernel through 4.5.2 does not ...)
 	{DSA-3607-1 DLA-516-1}
 	- linux 4.5.1-1
@@ -120705,7 +120698,6 @@ CVE-2016-1908 (The client in OpenSSH before 7.2 mishandles failed cookie generat
 	NOTE: vulnerability is partly due to /etc/X11/Xsession.d/35x11-common_xhost-local introduced in x11-common in 1:7.6+9 (wheezy and up)
 	NOTE: https://lists.debian.org/debian-lts/2016/01/msg00029.html
 	NOTE: Upstream announce: http://www.openssh.com/txt/release-7.2
-	NOTE: patched in https://salsa.debian.org/santiago/openssh/tree/jessie
 CVE-2016-1907 (The ssh_packet_read_poll2 function in packet.c in OpenSSH before 7.1p2 ...)
 	- openssh 1:7.1p2-1
 	[jessie] - openssh <not-affected> (Vulnerable code not present; Introduced in OpenSSH 6.8)
@@ -133353,7 +133345,6 @@ CVE-2015-6563 (The monitor component in sshd in OpenSSH before 7.0 on non-OpenBS
 	[squeeze] - openssh <no-dsa> (Minor issue)
 	NOTE: https://anongit.mindrot.org/openssh.git/commit/?id=d4697fe9a28dab7255c60433e4dd23cf7fce8a8b
 	NOTE: http://www.openwall.com/lists/oss-security/2015/08/11/9
-	NOTE: patched in https://salsa.debian.org/santiago/openssh/tree/jessie
 CVE-2015-6564 (Use-after-free vulnerability in the mm_answer_pam_free_ctx function in ...)
 	- openssh 1:6.9p1-1 (bug #795711)
 	[jessie] - openssh <postponed> (Minor issue)
@@ -133361,7 +133352,6 @@ CVE-2015-6564 (Use-after-free vulnerability in the mm_answer_pam_free_ctx functi
 	[squeeze] - openssh <no-dsa> (Minor issue)
 	NOTE: https://anongit.mindrot.org/openssh.git/commit/?id=5e75f5198769056089fb06c4d738ab0e5abc66f7
 	NOTE: http://www.openwall.com/lists/oss-security/2015/08/11/9
-	NOTE: patched in https://salsa.debian.org/santiago/openssh/tree/jessie
 CVE-2015-6737 (Cross-site scripting (XSS) vulnerability in the Widgets extension for ...)
 	NOT-FOR-US: Widgets extension for MediaWiki
 	NOTE: https://phabricator.wikimedia.org/T88964
@@ -134476,7 +134466,6 @@ CVE-2015-5600 (The kbdint_next_device function in auth2-chall.c in sshd in OpenS
 	NOTE: to yes. Default for KbdInteractiveAuthentication is to use whatever
 	NOTE: value ChallengeResponseAuthentication is set to, which is 'no' in
 	NOTE: default configurations in Debian.
-	NOTE: patched in https://salsa.debian.org/santiago/openssh/tree/jessie
 CVE-2015-5599 (Multiple SQL injection vulnerabilities in upload.php in the Powerplay ...)
 	NOT-FOR-US: Powerplay Gallery plugin for WordPress
 CVE-2015-5598

data/dla-needed.txt

@@ -86,8 +86,9 @@ openjpeg2
   NOTE: 20180719: there is no patch available for the remaining CVEs
 --
 openssh (Santiago)
-  NOTE: 20180822: Check current no-dsa issues. Some of them can be exploited for DoS, e.g.
-  NOTE: CVE-2016-6515
+  NOTE: 20180830: only no-dsa issues remain. wait for an issue warranting
+  NOTE: a DLA.
+  NOTE: WIP package in https://salsa.debian.org/santiago/openssh/tree/jessie
 --
 php5 (Roberto C. Sánchez)
 --