Accepted x2goclient 4.0.5.2-2+deb9u1 (source) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Sun, 22 Dec 2019 14:53:58 +0100
Source: x2goclient
Architecture: source
Version: 4.0.5.2-2+deb9u1
Distribution: stretch
Urgency: medium
Maintainer: Debian Remote Maintainers <pkg-remote-team@lists.alioth.debian.org>
Changed-By: Mike Gabriel <sunweaver@debian.org>
Closes: 947129
Changes:
x2goclient (4.0.5.2-2+deb9u1) stretch; urgency=medium
.
* debian/patches:
+ Add libssh-regression-fix-CVE-2019-14889.patch. In src/sshprocess.cpp:
strip ~/, ~user{,/}, ${HOME}{,/} and $HOME{,/} from destination paths
in scp mode. Fixes: #1428. This was already necessary for pascp (PuTTY-
based Windows solution for Kerberos support), but newer libssh versions
with the CVE-2019-14889 also interpret paths as literal strings.
(Closes: #947129).
Checksums-Sha1:
0244ba470443ff25216cf62258156e3803d78692 2427 x2goclient_4.0.5.2-2+deb9u1.dsc
337c99644163694d99a85f18599ae35a674cebbb 19392 x2goclient_4.0.5.2-2+deb9u1.debian.tar.xz
de6ec636d19cae96d7b01e822b0f3e527eb75745 9895 x2goclient_4.0.5.2-2+deb9u1_source.buildinfo
Checksums-Sha256:
52469be2c1d12427aa222235c4c3f1109ca43a51bf56890774993f7bb8831be5 2427 x2goclient_4.0.5.2-2+deb9u1.dsc
3b0b6f7d4235b7debbdd23a8d2ba40a33831f0a98b4773f48ffdda6413eaa0d2 19392 x2goclient_4.0.5.2-2+deb9u1.debian.tar.xz
fea1d7b4a076dc2a7aeeb08eb48ae555682ed25dcf6b28dfd8ca6855cdbbdbc0 9895 x2goclient_4.0.5.2-2+deb9u1_source.buildinfo
Files:
bf3e9fbeafc260e3c54370a6c791dda0 2427 x11 extra x2goclient_4.0.5.2-2+deb9u1.dsc
82e79762c750b1936d5450c74f6d21e5 19392 x11 extra x2goclient_4.0.5.2-2+deb9u1.debian.tar.xz
4ce8b8a1a3c761bc30c726dea03fe9e8 9895 x11 extra x2goclient_4.0.5.2-2+deb9u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJJBAEBCAAzFiEEm/uu6GwKpf+/IgeCmvRrMCV3GzEFAl3/dtsVHHN1bndlYXZl
ckBkZWJpYW4ub3JnAAoJEJr0azAldxsxBHYQAIkQh703jOSC4FNbNoEfR53Zrm5+
QRuRnuZZwFEBTUtwwaBAcOhrUyjpb6RygLBI8bPijeKV6sDdcz6eu8boAFETvkHY
iKFv3tyeagjOUMxrklm4CtD1Ml/wIA9+vcBKcEMPsaSgPUZgODSikAumW+2UAd95
ikoPifv6/DWXnD5KcNITFzl+d64HIWMwlxAOXLOVWuWDlHvnpiB8Cd721X8QyyiR
YGXXkRrPCXPcEoxwrToPRpo9ec8xFAw1fNCHHsvEyC5Ce91qMbVlSAvw/6N6qU1d
JUbVwGtCySC7Qr5K07efJQxubJ9XpZspFfN+8tWX7YmSy2Wh8a7w7HcOZHuUzxDZ
YMNXmmGz9nmFgbsnfeV5U9gV7CyvrLfBQqWR/a4IGkUvbPF3H9lpyA4TuWnKLeSs
Y5ODIspTMazS8ECQer8zWCtxx0Rfr+lMwpP9zEXrgpoRCcpuIjbTwNcbdae4Sx/u
N+zjhaGZbof7ogS2y6jBQGW6c/rxZWYlih2nRbIET+0DMR/ZXAzLXBorbdxYqPj8
OVhdX0z3EVzmeA5qEoU2tcD3zHwM01nY7ltUJ4cZ+QwFvzfOVnXcE/+x402boGzW
io3ziyI0kPj0LeT9oP+jDOfYPBRUL9MAzNkGweMfLPOJbgwLsYKhkFRppo1G0ctt
U+VclJXs/V0TGcVo
=tap0
-----END PGP SIGNATURE-----