rssh (2.3.4-4+deb8u2ubuntu0.14.04.2) trusty-security; urgency=medium

  * SECURITY REGRESSION: The previous security regression released in
    2.3.4-4+deb8u2ubuntu0.14.04.1 did not resolve all of the regressions
    caused by 2.3.4-4+deb8u2ubuntu0.14.04.1. This fix adds support for
    the '-pf' and '-pt' variants of the command line options.
    (LP: 1815741)

 -- Mike Salvatore <mike.salvatore@canonical.com>  Wed, 10 Apr 2019 12:44:43 -0400

rssh (2.3.4-4+deb8u2ubuntu0.14.04.1) trusty-security; urgency=medium

  * SECURITY REGRESSION: The fix for the scp security vulnerability
    in 2.3.4-4+deb8u2build0.14.04.1 introduced a regression that
    blocked scp of multiple files from a server using rssh.  Based on
    further analysis of scp's command-line parsing, relax the check
    to require the server command contain -f or -t, which should
    deactivate scp's support for remote files.  (Closes: #921655)
    - Merged from Debian, thanks to Russ Allbery for the patch.

 -- Steve Beattie <sbeattie@ubuntu.com>  Mon, 11 Feb 2019 17:24:20 -0800

rssh (2.3.4-4+deb8u2build0.14.04.1) trusty-security; urgency=medium

  * fake sync from Debian

 -- Steve Beattie <sbeattie@ubuntu.com>  Thu, 07 Feb 2019 14:18:02 -0800

rssh (2.3.4-4+deb8u2) jessie-security; urgency=high

  * Non-maintainer upload by the LTS team.
  * Backport security fixes prepared by Debian's maintainer of rssh (rra).
  * Also reject rsync --daemon and --config command-line options, which
    can be used to run arbitrary commands.  Thanks, Nick Cleaton.
    (CVE-2019-3463)
  * Unset the HOME environment variable when running rsync to prevent popt
    (against which rsync is linked) from loading a ~/.popt configuration
    file, which can run arbitrary commands on the server or redefine
    command-line options to bypass argument checking.  Thanks, Nick
    Cleaton.  (CVE-2019-3464)
  * Do not stop checking the rsync command line at --, since this can be
    an argument to some other option and later arguments may still be
    interpreted as options.  In the few cases where one needs to rsync to
    files named things like --rsh, the client can use ./--rsh instead.
    Thanks, Nick Cleaton.

 -- Russ Allbery <rra@debian.org>  Fri, 01 Feb 2019 20:28:01 -0800

rssh (2.3.4-4+deb8u1) jessie-security; urgency=high

  * Non-maintainer upload by the LTS team.
  * Backport security fixes prepared by Debian's maintainer of rssh.
  * Validate the allowed scp command line and only permit the flags used
    in server mode and only a single argument, to attempt to prevent use
    of ssh options to run arbitrary code on the server. This will break
    scp -3 to a system running rssh, which seems like an acceptable loss.
    (CVE-2019-1000018)
  * Tighten validation of the rsync command line to require --server be
    the first argument, which should prevent initiation of an outbound
    rsync command from the server, which in turn might allow execution of
    arbitrary code via ssh configuration similar to scp.
  * Add validation of the server command line after chroot when chroot is
    enabled. Prior to this change, dangerous argument filtering was not
    done when chroot was configured, allowing remote code execution inside
    the chroot in some configurations via the previous two bugs and via
    the mechanisms in CVE-2012-2251 and CVE-2012-2252.
  * Document that the cvs server-side dangerous option filtering is
    probably insufficient and should not be considered secure.

 -- Markus Koschany <apo@debian.org>  Wed, 30 Jan 2019 18:34:46 +0100

rssh (2.3.4-4) unstable; urgency=low

  * Fix typo in the example mkchroot script that causes it to fail to
    copy the libnss compat modules.  Patch from Jeremy Jongepier.
    (Closes: #729294)
  * This package is now maintained using gbp pq from git-buildpackage.
    Remove the TopGit glue and the obsolete README.source package and
    rename the patches based on the export convention of gbp pq.
  * Drop override to use xz compression for the binary package.  This is
    now the default in dpkg-buildpackage.
  * Update standards version to 3.9.5 (no changes required).
  * Translation updates:
    - Portuguese (Brazilian), thanks Fernando Ike de Oliveira.
      (Closes: #723148)
  * Reformat translations with debconf-updatepo.  Add some missing
    Language fields and update the Report-Msgid-Bugs-To address.

 -- Russ Allbery <rra@debian.org>  Sat, 07 Dec 2013 19:18:35 -0800

rssh (2.3.4-3) unstable; urgency=low

  * Patch the upstream build system to honor CFLAGS and CPPFLAGS as passed
    to configure.  This fixes use of hardening flags during the build.
    Thanks to Simon Ruderich for the patch.  (Closes: #709941)

 -- Russ Allbery <rra@debian.org>  Tue, 28 May 2013 14:37:10 -0700

rssh (2.3.4-2) unstable; urgency=low

  * Upload to unstable.
  * Fix implicit function declaration compiler warning from the svnserve
    patch.
  * Use xz compression for the Debian source and binary package.
  * Canonicalize the Vcs-Git and Vcs-Browser control fields.
  * Update standards version to 3.9.4 (no changes required).

 -- Russ Allbery <rra@debian.org>  Sat, 11 May 2013 17:09:30 -0700

rssh (2.3.4-1) experimental; urgency=low

  * New upstream release.
    - Merges fixes/command-line-checking.
    - Fix a (probably not exploitable) flaw in determining the command
      to run from the provided command line.
  * Adjust the installation process for the new upstream behavior of
    installing rssh.conf as rssh.conf.default.  The Debian package
    continues to install it as /etc/rssh.conf.
  * Add new logcheck ignore line for a new upstream log message.
  * Fix the log level for a notice of global svnserve access to use debug,
    matching the (patched) behavior for the other program types.
  * Fix the regular expression in the previous change to correctly match a
    literal period instead of any character.  (This fix is not critical,
    but adds further defense in depth.)  Remove an unused variable to
    silence compiler warnings.  Patch from Tomas Hoger.
  * Change debian/watch to use the sf.net redirector.

 -- Russ Allbery <rra@debian.org>  Fri, 07 Dec 2012 16:14:37 -0800

rssh (2.3.3-6) unstable; urgency=high

  * Fix several flaws in validation of rsync options.  Ensure --server
    cannot be hidden from the server by putting it after -- or as the
    argument to another option.  Verify that the -e option's value matches
    expectations rather than trying to look for invalid -e option values.
    (CVE-2012-2251)
  * Reject the rsync --rsh option even if it does not contain a trailing
    equal sign.  (CVE-2012-2252)

 -- Russ Allbery <rra@debian.org>  Thu, 22 Nov 2012 12:01:41 -0800

# For older changelog entries, run 'apt-get changelog rssh'
