rssh 2.3.4-4+deb8u1build0.16.04.1 source package in Ubuntu

Changelog

rssh (2.3.4-4+deb8u1build0.16.04.1) xenial-security; urgency=medium

  * fake sync from Debian

rssh (2.3.4-4+deb8u1) jessie-security; urgency=high

  * Non-maintainer upload by the LTS team.
  * Backport security fixes prepared by Debian's maintainer of rssh.
  * Validate the allowed scp command line and only permit the flags used
    in server mode and only a single argument, to attempt to prevent use
    of ssh options to run arbitrary code on the server. This will break
    scp -3 to a system running rssh, which seems like an acceptable loss.
    (CVE-2019-1000018)
  * Tighten validation of the rsync command line to require --server be
    the first argument, which should prevent initiation of an outbound
    rsync command from the server, which in turn might allow execution of
    arbitrary code via ssh configuration similar to scp.
  * Add validation of the server command line after chroot when chroot is
    enabled. Prior to this change, dangerous argument filtering was not
    done when chroot was configured, allowing remote code execution inside
    the chroot in some configurations via the previous two bugs and via
    the mechanisms in CVE-2012-2251 and CVE-2012-2252.
  * Document that the cvs server-side dangerous option filtering is
    probably insufficient and should not be considered secure.

 -- Mike Salvatore <email address hidden>  Tue, 05 Feb 2019 15:08:09 -0500