[ssh_x509] PKIX-SSH release 14.1.1

[ssh_x509 at roumenpetrov.info]

Hello,

Bug-fix  release 14.1.1 is available for immediate download.
This release contain one non-significant security correction. Use of third party resolver library is recommended.


(x) Security:

(*) bounds checking in getrrsetbyname() compatibility implementation
A specifically crafted response from domain name server could cause function to perform an out-of-bounds reads Does not appear to be exploitable beyond denial-of-service to the ssh(1) client. This function is called only if client option VerifyHostKeyDNS is set and is used to check CERT or SSHFP resource records. Compatibility implementation is used only if is not provided by system resolver library.


(x) Features:

(*) hash algorithms in SSHFP RR
Allow to specify hash algorithms used to generate SSHFP RR records for domain name servers.

(*) print daemon configuration file
Added daemon option -G that parses and prints the effective configuration without attempting to load private keys and perform other checks.

(*) use sha256 when testing usability of rsa private key

(*) rewrite checks for Kerberos 5 implementations
Simplify, unify, and modernise configuration tests. In addition is added pkg-config based rule.


(x) Bugs:

(*) non-ascii file name in progress meter
Rewrite progress meter to manage properly non-ascii file names.

(*) clean channel flags
Clean "file descriptors" flags when channel is closed. Note functionality was added in PKIX-SSH 14.1.

(*) fix memory leak in sftp filename autocomplete

(*) fix memory leak in sftp ls command if file status is not available


(x) Misc:

(*) improved manual pages

(*) limit number of entries in "extension negotiation"

(*) minimise warnings raised by static analysers
code clean-up - for instance remove unused secsh "compatibility" flags


Regards,
Roumen Petrov

-- 
Advanced secure shell implementation with X.509 certificate support
http://roumenpetrov.info/secsh/