[ssh_x509] PKIX-SSH release 14.2

[ssh_x509 at roumenpetrov.info]

P.S. As before required minimum OpenSSL version is 0.9.7.

Roumen

ssh_x509 at roumenpetrov.info wrote:
> Hello,
>
> Mostly bug fix release 14.2 is available for immediate download. This release contain critical security correction.
>
> Mail list with changes follow:
>
> (x) Security:
>
> (*) pkcs#11 module misuse
> Do not allow pkcs11 providers by default. Fixes finally CVE-2016-10009 and mitigates CVE-2023-38408.
>
>
> (x) Features:
> (*) connection tupple
> Add new daemon token - connection tupple(%C).
>
> (*) forward unix domain socket
> Experimental support for unix domain sockets to client forward request.
>
> (*) match localnetwork
> Add "localnetwork" case to match criteria.
>
> (*) configuration tags
> Support tags in client configuration.
>
> (*) android failback path
> Drop obsolete "failback path" management from Android packaging.
>
> (*) "command" based path model
> "command" based path model for Android application. Reserved for future.
>
>
> (x) Bugs:
> (*) fix public key serialisation if key contain only X.509 distinguished name
>
> (*) print correctly some PKCS#11 information
>
> (*) fork after authentication
> Ensure that fork after authentication work properly in multiplexed cases.
>
> (*) timeout in multiplexing
> Apply connection timeout to multiplexing local socket connections.
>
> (*) hostname canonicalization
> Do not disable hostname canonicalization if ProxyJump=none is used.
>
> (*) "no comment" for keys
> Resolved issue with missing "no comment" when keys without comment is processed after key with comment.
>
> (*) paraller sftp
> Try to fix crappy OpenBSD sftp client in parallel cases.
>
> (x) Misc:
> (*) remote terminal
> Do not open terminal when is requested do not execute command on remote.
>
> (*) scp in sftp
> Check in advance for source file when secure copy in sftp mode copy local to remote files.
>
> (*) correct a number of memory leaks
>
> (*)  added checks for OpenSSL 3.0 releases
>
> (*) avoid matchpathcon
> Use selabel_lookup instead deprecated selinux matchpathcon function.
>
> (*) stop printing of "scanned" key information on output error
>
> (*) update ssh-copy-id script
>
>
> For detailed list of changes see commit history.
>
>
> Regards,
> Roumen Petrov
>


-- 
Advanced secure shell implementation with X.509 certificate support
http://roumenpetrov.info/secsh/