CVS commit: pkgsrc/security/py-asyncssh

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Mon Oct  5 13:21:25 UTC 2026

Modified Files:
        pkgsrc/security/py-asyncssh: Makefile distinfo

Log Message:
py-asyncssh: updated to 2.24.1

2.24.1 (3 Oct 2026)

* Fixed a potential "short read/write" issue in SFTP, potentially
  requiring multiple calls to successfully read or write all the data
  an application requests. Thanks go to Landon Peng for reporting
  this issue.

* Added protection against unreasonable packet lengths when parsing
  SSH and SFTP packets, avoiding a potential denial of service attack.
  Thanks go to zhangph (GitHub user afldl) for suggesting this change.

* Added restrictions on which SSH channel requests are allowed to be
  sent more than once on a channel. Thanks go to zhangph (GitHub user
  afldl) for reporting this issue for shell/exec/subsystem requests.

* Improved error reporting of a client trying to set multiple attributes
  on a file, when some of the operations aren't supported. Thanks go to
  Kevin O'Neil for reporting this issue and helping to test this fix.

* Improved path sanitizaation for SCP, to protect against additional
  "path traversal" attacks. Thanks go to GitHub user jankesec for
  reporting the issue and providing a proposed fix.

* Fixed a race condition in server authentication that could result
  in the wrong username being set as the authenticated user.

* Fixed a possible leak of options across authentication attempts when
  multiple authentication requests are attempted on a connection.
  Thanks go to GitHub user 0xW41th for reporting this issue and
  providing a suggested fix.

* Fixed multiple SFTP "path traversal" issues, where a malicious SFTP
  server could trick an SFTP client into writing outside of the
  requested target directory. Thanks go to Youjoon Yoon, Khizar
  Ali Shah, and GitHub user L1nq0 for reporting these issues and
  suggesting possible fixes.

* Fixed multiple SFTP chroot escape issues, where a client could read
  and write files outside of a chroot'd AsyncSSH SFTP server. Thanks
  go to GitHub user LorenzMap, Arpit Jain, and Mario Madersbacher for
  reporting these issues and suggesting possible fixes.

* Fixed revocation checking to handle the case where a host certificate
  is sent with a trusted CA but where the host key within the
  certificate is marked as revoked. Thanks go to Mohammad Thabet Hassan
  for reporting this issue.

* Fixed SSH channels receive window updates to be properly tracked
  when reading on the channel is paused. Thanks go to GitHub user
  Sumit-2004 for reporting this issue.

* Changed SSH config file username token substitution to disallow
  the username from being an empty string, avoiding a possible
  vulnerability. Thanks go to GitHub user L1nq0 for reporting this
  issue and proposing possible fixes.

* Fixed deprecation errors on des-cbc and des2-cbc ciphers.

* Added pre-commit hooks, including spell checking, and fixed various
  errors found by that. Thanks go to Waket Zheng for providing an
  initial versiosn of this.


To generate a diff of this commit:
cvs rdiff -u -r1.60 -r1.61 pkgsrc/security/py-asyncssh/Makefile
cvs rdiff -u -r1.51 -r1.52 pkgsrc/security/py-asyncssh/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/py-asyncssh/Makefile
diff -u pkgsrc/security/py-asyncssh/Makefile:1.60 pkgsrc/security/py-asyncssh/Makefile:1.61
--- pkgsrc/security/py-asyncssh/Makefile:1.60   Wed Jul  1 13:06:33 2026
+++ pkgsrc/security/py-asyncssh/Makefile        Mon Oct  5 13:21:24 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.60 2026/07/01 13:06:33 adam Exp $
+# $NetBSD: Makefile,v 1.61 2026/10/05 13:21:24 adam Exp $
 
-DISTNAME=      asyncssh-2.24.0
+DISTNAME=      asyncssh-2.24.1
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    security python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=a/asyncssh/}

Index: pkgsrc/security/py-asyncssh/distinfo
diff -u pkgsrc/security/py-asyncssh/distinfo:1.51 pkgsrc/security/py-asyncssh/distinfo:1.52
--- pkgsrc/security/py-asyncssh/distinfo:1.51   Wed Jul  1 13:06:33 2026
+++ pkgsrc/security/py-asyncssh/distinfo        Mon Oct  5 13:21:24 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.51 2026/07/01 13:06:33 adam Exp $
+$NetBSD: distinfo,v 1.52 2026/10/05 13:21:24 adam Exp $
 
-BLAKE2s (asyncssh-2.24.0.tar.gz) = f924803cb53c7d76fa7e8f3a9398c369e1018d581cf96e6455af8678a80557f9
-SHA512 (asyncssh-2.24.0.tar.gz) = f8504dc52945424da34812e2a08b9d6d00f69a2d30f55ec25df4e41b31419a368852f3124a885e62012520b255838599101b32ae7a8ed4abd5d926ce1c6ca72b
-Size (asyncssh-2.24.0.tar.gz) = 550148 bytes
+BLAKE2s (asyncssh-2.24.1.tar.gz) = de5bd68d3d1b05a98da2bfb1309deb6ec77231a5c0bd8d022ff5183f828d3efa
+SHA512 (asyncssh-2.24.1.tar.gz) = 54b8e6a9519781f5e5d5c394b2b5780d7d88880c3c17ccdd30edf856d21c9201d6a390dcfb348f736ecc4158e8e3b053ceb48ba5e6f285598b8fed12b056d0e1
+Size (asyncssh-2.24.1.tar.gz) = 558085 bytes