gentoo auto-resync : 28:12:2023 - 07:37:55

6 files changed, 106 insertions, 17 deletions

diff --git a/metadata/glsa/Manifest b/metadata/glsa/Manifest
index 3c17e8835f9c..7bee389eabff 100644
--- a/metadata/glsa/Manifest
+++ b/metadata/glsa/Manifest
@@ -1,23 +1,23 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA512
 
-MANIFEST Manifest.files.gz 557878 BLAKE2B d964d8dd39b9fddad347a3b0cce79b253f7c2efa5bf3bc93d19cabebf20d9a14bbbd36a5dfe2d5a69513d31fe61b4de397efeeffd9671d7eba9130b43271340d SHA512 71a312c8dd53040a02e820c56b23592dcf5a12481c051f6b1474b8597a5f01f85157f33a02bcd3982905a0457bbb5d59d3e4aca4a654b4214145ffe3cefb1883
-TIMESTAMP 2023-12-28T01:10:18Z
+MANIFEST Manifest.files.gz 558197 BLAKE2B dde0fd5bc1749affc0b48b285b7ab9bd0a7216628f650cd3cbf0e6b2a1788ebd2dc667afbfee3491b42c071ba583d8c7e204468384a8f639b22206d6cbf47903 SHA512 6a3cf3862910d3680e54853c513e07b7a7d791fa5a5732653e79584f351498dd0ac5f7c244cf38dd9920afd7da27fd2c1e7a51770500da41d964a2a5ddd6ec92
+TIMESTAMP 2023-12-28T07:10:20Z
 -----BEGIN PGP SIGNATURE-----
 
-iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmWMyvpfFIAAAAAALgAo
+iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmWNH1xfFIAAAAAALgAo
 aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
 RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
-klBHHxAAmXE4YJ0BkXuBfnckhXUMdKkesqBtlGikFvNdf5Il+tv/DFX6xU8GNeKf
-FaVg74xbJ4OA08gfWkqDR2Za32S4wIXY8j+EmjtPu+I92Vcr+K3ErQoO119Fs+Hw
-RcKbEIStJrOKjZ1/e/L/sFNMO4eWreW4vMYtcWyL7snXPHnmNbyojGcCZHVpCWfJ
-w/IAa2HLvqRlm0qwx9pfM4IsmJkud2EHMR3Ls5/wwHNHxcl0o3jO+UV2tMoAWHzH
-SdPXSJVdp7yq7odlCtStcwmyoDlTtQoIB028D7CMC54GT15I74djJJwD7qP4CLWf
-zLUJIjQ0YkBD03jIAJsJAznsjBt0ZGVoQmersRAbBIeQ9KZ4J0LqB2yWtTgHzlUY
-mCDwNTupMmxJG3yj6F/McYAvU2XcqA3dOisU2RnNT6F6+xFLEsxnfHYlx2wDuzBv
-LjyaOaRbUTvzMuVUMERPkc9rpZsMH/DMCdHzCdPr5jj7lj9azJWc7P2vXTu/gnF/
-TlrCV0v3S+71itYR7EAmRvRqUmS+N/iB26ToDn2iQUTz5jDk3jPYrzKkxrXICGkp
-F92kRb/W1ZSkSjmT+5f5ttKBgg352o37rsgDvOWAjb0es4HT2ReJvxo41teE2zwV
-//1UgNCESjW2eMh1nPEkOLzycgk2k+MmuxvqVroiL6bC1lT3qpI=
-=Jd5C
+klCkHw//TgxRjA0Ryx+bUpp7WvO+Qp33/+orp327NDQt5NCnEp2u2niWGaeOxYgx
+m0Vfz5BKvDQy8e84ISv949uiMyNIIcn3DXn3/QOmetW2F42UeHWOFHsAb2mCGdAs
+VNyX8URvjcM8zOkD1i5E9pgzbR68pbWNe4yJ8ZBwtfuj0T3z+let/dnvPPno0FFh
+R4mpbc0IQOcC4hyWxZTjmqHDfIJd+nhffOBau93SfTfj5G3+Sl+lU1p2OLEuE5td
+mMjkoghxL/YvSaUllzK60ewlfsVfigV6gsJHXPiqggc6qKsb3LhRJlPReyBP7ewg
+YCvI38J1N5cU+ovY8qGg26+1+f+GURNYs+1T7KI8lUWck4j45IlGy9U4gQOk4VEC
+mqPq64UN19OKsXaul6jqctBNKB+bOuy+8zUZ3VQvvEB9T03TEk2wtCVP19S1Ra4m
+QVUNo2E9mL2iMnALhHlICoitH8qCAAcW2MbznHcyqNGZJ06bV55PavkD48NqBPRE
+K5Uxsl8l3VMwPbNUxvgriSXylJ3qVv0ynL2vEeahlTdldMK8c+t82TiXzsLbmAMY
+cJepDDIXPfZ/Il5sp0tcBeWZSPeUfNpuxjVBW6mqxEm04wubgYZB/tSx8t0Udi6I
++yxjj1rjdZJudnJlOzKh7Kr/AuNDNQNXUjvw5hfMEQKwnwErS0o=
+=K8R3
 -----END PGP SIGNATURE-----
diff --git a/metadata/glsa/Manifest.files.gz b/metadata/glsa/Manifest.files.gz
index 0f851a245f9c..c1be36f2d992 100644
--- a/metadata/glsa/Manifest.files.gz
+++ b/metadata/glsa/Manifest.files.gz
diff --git a/metadata/glsa/glsa-202312-16.xml b/metadata/glsa/glsa-202312-16.xml
new file mode 100644
index 000000000000..9b577f4d4008
--- /dev/null
+++ b/metadata/glsa/glsa-202312-16.xml
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202312-16">
+    <title>libssh: Multiple Vulnerabilities</title>
+    <synopsis>Multiple vulnerabilities have been discovered in libssh, the worst of which could lead to code execution.</synopsis>
+    <product type="ebuild">libssh</product>
+    <announced>2023-12-28</announced>
+    <revised count="1">2023-12-28</revised>
+    <bug>920291</bug>
+    <bug>920724</bug>
+    <access>remote</access>
+    <affected>
+        <package name="net-libs/libssh" auto="yes" arch="*">
+            <unaffected range="ge">0.10.6</unaffected>
+            <vulnerable range="lt">0.10.6</vulnerable>
+        </package>
+    </affected>
+    <background>
+        <p>libssh is a multiplatform C library implementing the SSHv2 protocol on client and server side.</p>
+    </background>
+    <description>
+        <p>Multiple vulnerabilities have been discovered in libssh. Please review the CVE identifiers referenced below for details.</p>
+    </description>
+    <impact type="high">
+        <p>Please review the referenced CVE identifiers for details.</p>
+    </impact>
+    <workaround>
+        <p>There is no known workaround at this time.</p>
+    </workaround>
+    <resolution>
+        <p>All libssh users should upgrade to the latest version:</p>
+        
+        <code>
+          # emerge --sync
+          # emerge --ask --oneshot --verbose ">=net-libs/libssh-0.10.6"
+        </code>
+    </resolution>
+    <references>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-6004">CVE-2023-6004</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-48795">CVE-2023-48795</uri>
+    </references>
+    <metadata tag="requester" timestamp="2023-12-28T02:21:10.983119Z">sam</metadata>
+    <metadata tag="submitter" timestamp="2023-12-28T02:21:10.985632Z">sam</metadata>
+</glsa>
\ No newline at end of file
diff --git a/metadata/glsa/glsa-202312-17.xml b/metadata/glsa/glsa-202312-17.xml
new file mode 100644
index 000000000000..a6dcf8901542
--- /dev/null
+++ b/metadata/glsa/glsa-202312-17.xml
@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202312-17">
+    <title>OpenSSH: Multiple Vulnerabilities</title>
+    <synopsis>Multiple vulnerabilities have been discovered in OpenSSH, the worst of which could lead to code execution.</synopsis>
+    <product type="ebuild">openssh</product>
+    <announced>2023-12-28</announced>
+    <revised count="1">2023-12-28</revised>
+    <bug>920292</bug>
+    <bug>920722</bug>
+    <access>remote</access>
+    <affected>
+        <package name="net-misc/openssh" auto="yes" arch="*">
+            <unaffected range="ge">9.6_p1</unaffected>
+            <vulnerable range="lt">9.6_p1</vulnerable>
+        </package>
+    </affected>
+    <background>
+        <p>OpenSSH is a free application suite consisting of server and clients that replace tools like telnet, rlogin, rcp and ftp with more secure versions offering additional functionality.</p>
+    </background>
+    <description>
+        <p>Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details.</p>
+    </description>
+    <impact type="high">
+        <p>Please review the referenced CVE identifiers for details.</p>
+    </impact>
+    <workaround>
+        <p>There is no known workaround at this time.</p>
+    </workaround>
+    <resolution>
+        <p>All OpenSSH users should upgrade to the latest version:</p>
+        
+        <code>
+          # emerge --sync
+          # emerge --ask --oneshot --verbose ">=net-misc/openssh-9.6_p1"
+        </code>
+    </resolution>
+    <references>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-48795">CVE-2023-48795</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-51385">CVE-2023-51385</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-51385,CVE-2023-48795">CVE-2023-51385,CVE-2023-48795</uri>
+    </references>
+    <metadata tag="requester" timestamp="2023-12-28T02:21:28.668404Z">sam</metadata>
+    <metadata tag="submitter" timestamp="2023-12-28T02:21:28.672567Z">sam</metadata>
+</glsa>
\ No newline at end of file
diff --git a/metadata/glsa/timestamp.chk b/metadata/glsa/timestamp.chk
index 3b5f66b383f1..48711015ac5e 100644
--- a/metadata/glsa/timestamp.chk
+++ b/metadata/glsa/timestamp.chk
@@ -1 +1 @@
-Thu, 28 Dec 2023 01:10:14 +0000
+Thu, 28 Dec 2023 07:10:17 +0000
diff --git a/metadata/glsa/timestamp.commit b/metadata/glsa/timestamp.commit
index 96c0e8af95f4..352527083875 100644
--- a/metadata/glsa/timestamp.commit
+++ b/metadata/glsa/timestamp.commit
@@ -1 +1 @@
-2c2ec5453e20060d4ec1717825d2874f0e663f91 1703663382 2023-12-27T07:49:42+00:00
+3dfe782899716a3480c9481c69bca8c231c663a7 1703730129 2023-12-28T02:22:09+00:00