[PATCH 0/2] libssh / libssh2 security updates

[Leo Famulari]

These patches address CVE-2016-0739 (libssh) and CVE-2016-0786 (libssh2)
[0].

For libssh, we update to the latest upstream release, 0.7.3.

Guile-ssh depends on a private package of an older version of libssh [1], so
we update that private package to the latest version supported by
guile-ssh, 0.6.5. This happens to be the previous version of our public
libssh package.

This allows us to remove the patch for CVE-2014-0017, which was fixed in
libssh-0.6.3 [2].

For libssh2, we update to the latest upstream release, 1.7.0.

Many packages depend on libssh2, including curl, so we create a
temporary package of the old, vulnerable version, 1.4. When we have
rebuilt all packages affected by CVE-2016-0786, this temporary package
should be removed and curl should be made to depend on the latest
version. That future commit should state "Fixes CVE-2016-7087".

Please double check that curl does not need to be rebuilt before
applying these patches. Feel free to reorganize them changes or alter
the commit messages as desired.

[0]
http://seclists.org/oss-sec/2016/q1/408
http://www.libssh.org/archive/libssh/2016-02/0000013.html
https://libssh2.org/changes.html

[1]
https://github.com/artyom-poptsov/guile-ssh#requirements

[2]
https://www.libssh.org/2014/03/04/libssh-0-6-3-security-release/
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0017


Leo Famulari (2):
  gnu: libssh2: Update to 1.7.0.
  gnu: libssh: Update to 0.7.3.

 gnu-system.am                                   |  1 -
 gnu/packages/curl.scm                           |  2 +-
 gnu/packages/patches/libssh-CVE-2014-0017.patch | 89 -------------------------
 gnu/packages/ssh.scm                            | 48 +++++++++----
 4 files changed, 35 insertions(+), 105 deletions(-)
 delete mode 100644 gnu/packages/patches/libssh-CVE-2014-0017.patch

-- 
2.7.1