[ssh_x509] PKIX-SSH release 19.1

[ssh_x509 at roumenpetrov.info]

Hello,

A new "bugfix" PKIX-SSH release is available for download.
The main reason is to update "compatibility release" in ssh identification string.

Note so called "session bind" agent functionality is not supported by PKIX-SSH. A security fix related to functionality introduce a new design flow - allowing a request to update a locked agent.
Another set of defects in "compatibility release" is related to regression in configuration parser. Also out of scope to the PKIX-SSH.


Please find list with corrections in this release:


(x) Security:

(*) fix RSA certificate signature policy bypass via SSH_BUG_SIGTYPE
Accept only designed signatures for RSA with SHA2 custom certificates.

(*) avoid potential use-after-free in client remote forwarding


(x) Features:

(*) for errors in packet use only specific fatal
The specific function provides context of the failing peer.


(x) Bugs:

(*) ensure that restricted authentication blocks tunnel forwarding
     Note tunnel forwarding is disabled by default.

(*) handle ChannelTimeout and RekeyLimit directives in the match block


(x) Misc:

(*) updated the format of the information for the current secure shell connection
     Output "traffic" details on separate lines. Ensure equally adjusted label and detail offset.

(*) make the reading protocol version exchange non-blocking in the key gather utility

(*) process agent "query" extension while locked

(*) improved manual pages

(*) removed outdated README documents
The information about tunneling and platform support is too outdated.

(*) test unification and optimizations


Regards,
Roumen Petrov