[ssh_x509] PKIX-SSH release 14.2

[ssh_x509 at roumenpetrov.info]

Hello,

Mostly bug fix release 14.2 is available for immediate download. This release contain critical security correction.

Mail list with changes follow:

(x) Security:

(*) pkcs#11 module misuse
Do not allow pkcs11 providers by default. Fixes finally CVE-2016-10009 and mitigates CVE-2023-38408.


(x) Features:
(*) connection tupple
Add new daemon token - connection tupple(%C).

(*) forward unix domain socket
Experimental support for unix domain sockets to client forward request.

(*) match localnetwork
Add "localnetwork" case to match criteria.

(*) configuration tags
Support tags in client configuration.

(*) android failback path
Drop obsolete "failback path" management from Android packaging.

(*) "command" based path model
"command" based path model for Android application. Reserved for future.


(x) Bugs:
(*) fix public key serialisation if key contain only X.509 distinguished name

(*) print correctly some PKCS#11 information

(*) fork after authentication
Ensure that fork after authentication work properly in multiplexed cases.

(*) timeout in multiplexing
Apply connection timeout to multiplexing local socket connections.

(*) hostname canonicalization
Do not disable hostname canonicalization if ProxyJump=none is used.

(*) "no comment" for keys
Resolved issue with missing "no comment" when keys without comment is processed after key with comment.

(*) paraller sftp
Try to fix crappy OpenBSD sftp client in parallel cases.

(x) Misc:
(*) remote terminal
Do not open terminal when is requested do not execute command on remote.

(*) scp in sftp
Check in advance for source file when secure copy in sftp mode copy local to remote files.

(*) correct a number of memory leaks

(*)  added checks for OpenSSL 3.0 releases

(*) avoid matchpathcon
Use selabel_lookup instead deprecated selinux matchpathcon function.

(*) stop printing of "scanned" key information on output error

(*) update ssh-copy-id script


For detailed list of changes see commit history.


Regards,
Roumen Petrov

-- 
Advanced secure shell implementation with X.509 certificate support
http://roumenpetrov.info/secsh/