[DSA 5601-1] php-phpseclib3 security update
[DSA 5600-1] php-phpseclib security update
[DSA 5599-1] phpseclib security update
[DSA 5601-1] php-phpseclib3 security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5601-1 security@debian.org
https://www.debian.org/security/ Sebastien Delafond
January 12, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : php-phpseclib3
CVE ID : CVE-2023-48795
Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the
SSH protocol is prone to a prefix truncation attack, known as the
"Terrapin attack". This attack allows a MITM attacker to effect a
limited break of the integrity of the early encrypted SSH transport
protocol by sending extra messages prior to the commencement of
encryption, and deleting an equal number of consecutive messages
immediately after encryption starts.
Details can be found at https://terrapin-attack.com/
For the stable distribution (bookworm), this problem has been fixed in
version 3.0.19-1+deb12u2.
We recommend that you upgrade your php-phpseclib3 packages.
For the detailed security status of php-phpseclib3 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/php-phpseclib3
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[DSA 5600-1] php-phpseclib security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5600-1 security@debian.org
https://www.debian.org/security/ Sebastien Delafond
January 12, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : php-phpseclib
CVE ID : CVE-2023-48795
Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the
SSH protocol is prone to a prefix truncation attack, known as the
"Terrapin attack". This attack allows a MITM attacker to effect a
limited break of the integrity of the early encrypted SSH transport
protocol by sending extra messages prior to the commencement of
encryption, and deleting an equal number of consecutive messages
immediately after encryption starts.
Details can be found at https://terrapin-attack.com/
For the oldstable distribution (bullseye), this problem has been fixed
in version 2.0.30-2+deb11u1.
For the stable distribution (bookworm), this problem has been fixed in
version 2.0.42-1+deb12u1.
We recommend that you upgrade your php-phpseclib packages.
For the detailed security status of php-phpseclib please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/php-phpseclib
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[DSA 5599-1] phpseclib security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5599-1 security@debian.org
https://www.debian.org/security/ Sebastien Delafond
January 12, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : phpseclib
CVE ID : CVE-2023-48795
Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the
SSH protocol is prone to a prefix truncation attack, known as the
"Terrapin attack". This attack allows a MITM attacker to effect a
limited break of the integrity of the early encrypted SSH transport
protocol by sending extra messages prior to the commencement of
encryption, and deleting an equal number of consecutive messages
immediately after encryption starts.
Details can be found at https://terrapin-attack.com/
For the oldstable distribution (bullseye), this problem has been fixed
in version 1.0.19-3+deb11u1.
For the stable distribution (bookworm), this problem has been fixed in
version 1.0.20-1+deb12u1.
We recommend that you upgrade your phpseclib packages.
For the detailed security status of phpseclib please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/phpseclib
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
