CVS commit: pkgsrc/security/py-paramiko

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Fri Sep 21 11:04:16 UTC 2018

Modified Files:
        pkgsrc/security/py-paramiko: Makefile PLIST distinfo
        pkgsrc/security/py-paramiko/patches: patch-paramiko_ssh__gss.py

Log Message:
py-paramiko: updated to 2.4.2

2.4.2:
Fix exploit (CVE pending) in Paramiko’s server mode (not client mode) where hostile clients could trick the server into thinking they were authenticated without actually submitting valid 
authentication.

Specifically, steps have been taken to start separating client and server related message types in the message handling tables within Transport and AuthHandler; this work is not complete but enough 
has been performed to close off this particular exploit (which was the only obvious such exploit for this particular channel).

Modify protocol message handling such that Transport does not respond to MSG_UNIMPLEMENTED with its own MSG_UNIMPLEMENTED. This behavior probably didn’t cause any outright errors, but it doesn’t seem 
to conform to the RFCs and could cause (non-infinite) feedback loops in some scenarios (usually those involving Paramiko on both ends).
Add *.pub files to the MANIFEST so distributed source packages contain some necessary test assets. Credit: Alexander Kapshuna.
Backport pytest support and application of the black code formatter (both of which previously only existed in the 2.4 branch and above) to everything 2.0 and newer. This makes back/forward porting 
bugfixes significantly easier.
Backport changes from 979 (added in Paramiko 2.3) to Paramiko 2.0-2.2, using duck-typing to preserve backwards compatibility. This allows these older versions to use newer Cryptography sign/verify 
APIs when available, without requiring them (as is the case with Paramiko 2.3+).


To generate a diff of this commit:
cvs rdiff -u -r1.33 -r1.34 pkgsrc/security/py-paramiko/Makefile
cvs rdiff -u -r1.15 -r1.16 pkgsrc/security/py-paramiko/PLIST
cvs rdiff -u -r1.19 -r1.20 pkgsrc/security/py-paramiko/distinfo
cvs rdiff -u -r1.1 -r1.2 \
    pkgsrc/security/py-paramiko/patches/patch-paramiko_ssh__gss.py

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/py-paramiko/Makefile
diff -u pkgsrc/security/py-paramiko/Makefile:1.33 pkgsrc/security/py-paramiko/Makefile:1.34
--- pkgsrc/security/py-paramiko/Makefile:1.33   Thu Sep  6 13:28:00 2018
+++ pkgsrc/security/py-paramiko/Makefile        Fri Sep 21 11:04:16 2018
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.33 2018/09/06 13:28:00 adam Exp $
+# $NetBSD: Makefile,v 1.34 2018/09/21 11:04:16 adam Exp $
 
-DISTNAME=      paramiko-2.4.1
+DISTNAME=      paramiko-2.4.2
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    security python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=p/paramiko/}

Index: pkgsrc/security/py-paramiko/PLIST
diff -u pkgsrc/security/py-paramiko/PLIST:1.15 pkgsrc/security/py-paramiko/PLIST:1.16
--- pkgsrc/security/py-paramiko/PLIST:1.15      Tue Mar 13 18:35:29 2018
+++ pkgsrc/security/py-paramiko/PLIST   Fri Sep 21 11:04:16 2018
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.15 2018/03/13 18:35:29 adam Exp $
+@comment $NetBSD: PLIST,v 1.16 2018/09/21 11:04:16 adam Exp $
 ${PYSITELIB}/${EGG_INFODIR}/PKG-INFO
 ${PYSITELIB}/${EGG_INFODIR}/SOURCES.txt
 ${PYSITELIB}/${EGG_INFODIR}/dependency_links.txt
@@ -19,9 +19,6 @@ ${PYSITELIB}/paramiko/agent.pyo
 ${PYSITELIB}/paramiko/auth_handler.py
 ${PYSITELIB}/paramiko/auth_handler.pyc
 ${PYSITELIB}/paramiko/auth_handler.pyo
-${PYSITELIB}/paramiko/authenticator.py
-${PYSITELIB}/paramiko/authenticator.pyc
-${PYSITELIB}/paramiko/authenticator.pyo
 ${PYSITELIB}/paramiko/ber.py
 ${PYSITELIB}/paramiko/ber.pyc
 ${PYSITELIB}/paramiko/ber.pyo

Index: pkgsrc/security/py-paramiko/distinfo
diff -u pkgsrc/security/py-paramiko/distinfo:1.19 pkgsrc/security/py-paramiko/distinfo:1.20
--- pkgsrc/security/py-paramiko/distinfo:1.19   Tue Mar 13 18:35:29 2018
+++ pkgsrc/security/py-paramiko/distinfo        Fri Sep 21 11:04:16 2018
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.19 2018/03/13 18:35:29 adam Exp $
+$NetBSD: distinfo,v 1.20 2018/09/21 11:04:16 adam Exp $
 
-SHA1 (paramiko-2.4.1.tar.gz) = 2b35a8016e45ae96f949ba7a8c2d67fa41aa673e
-RMD160 (paramiko-2.4.1.tar.gz) = bb44b3ed135910faf5980b6421a4e3e2fae0d571
-SHA512 (paramiko-2.4.1.tar.gz) = c9ff6e3bd6d779e73e04158efa360d8d7e1dabe7f63fcda47765010d6fa501db6309879a9825bedb3968ea618fccfba8f4284c897713f5c9a22ebaa4170c1839
-Size (paramiko-2.4.1.tar.gz) = 1490565 bytes
-SHA1 (patch-paramiko_ssh__gss.py) = 836bfbd753d7543811f9d0319c6d61054dfefd5e
+SHA1 (paramiko-2.4.2.tar.gz) = 7ab1e9aaf0b6eedb2098661d283f4d6f6d9c8963
+RMD160 (paramiko-2.4.2.tar.gz) = 1231cb22ca4457e5835015d4abc215621b24e4c2
+SHA512 (paramiko-2.4.2.tar.gz) = ebf277022ff0e26316cc1d3fc8d37918fb4b13f819e11a38dbafc7a77a1a4faf2d0b58ef60a582b9c66fb0650a453ae93ab405c04298fbaea83118bdf9a87906
+Size (paramiko-2.4.2.tar.gz) = 1207299 bytes
+SHA1 (patch-paramiko_ssh__gss.py) = e6f42443ee6e96c344ed84779f81a5a133eb06d5

Index: pkgsrc/security/py-paramiko/patches/patch-paramiko_ssh__gss.py
diff -u pkgsrc/security/py-paramiko/patches/patch-paramiko_ssh__gss.py:1.1 pkgsrc/security/py-paramiko/patches/patch-paramiko_ssh__gss.py:1.2
--- pkgsrc/security/py-paramiko/patches/patch-paramiko_ssh__gss.py:1.1  Thu Mar 29 15:35:32 2018
+++ pkgsrc/security/py-paramiko/patches/patch-paramiko_ssh__gss.py      Fri Sep 21 11:04:16 2018
@@ -1,9 +1,9 @@
-$NetBSD: patch-paramiko_ssh__gss.py,v 1.1 2018/03/29 15:35:32 adam Exp $
+$NetBSD: patch-paramiko_ssh__gss.py,v 1.2 2018/09/21 11:04:16 adam Exp $
 
 Paramiko does not work with current py-gssapi.
 https://github.com/paramiko/paramiko/issues/1069
 
---- paramiko/ssh_gss.py.orig   2017-10-30 11:10:54.000000000 +0000
+--- paramiko/ssh_gss.py.orig   2018-09-19 04:21:52.000000000 +0000
 +++ paramiko/ssh_gss.py
 @@ -50,7 +50,7 @@ from pyasn1.codec.der import encoder, de
  _API = "MIT"
@@ -11,6 +11,6 @@ https://github.com/paramiko/paramiko/iss
  try:
 -    import gssapi
 +    import gssapi_fails
+ 
      GSS_EXCEPTIONS = (gssapi.GSSException,)
  except (ImportError, OSError):
-     try: