pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: pkgsrc/security/openssh
Module Name: pkgsrc
Committed By: wiz
Date: Thu Feb 2 13:31:12 UTC 2023
Modified Files:
pkgsrc/security/openssh: Makefile distinfo
Log Message:
Changes since OpenSSH 9.1
=========================
This release fixes a number of security bugs.
Security
========
This release contains fixes for two security problems and a memory
safety problem. The memory safety problem is not believed to be
exploitable, but we report most network-reachable memory faults as
security bugs.
* sshd(8): fix a pre-authentication double-free memory fault
introduced in OpenSSH 9.1. This is not believed to be exploitable,
and it occurs in the unprivileged pre-auth process that is
subject to chroot(2) and is further sandboxed on most major
platforms.
* ssh(8): in OpenSSH releases after 8.7, the PermitRemoteOpen option
would ignore its first argument unless it was one of the special
keywords "any" or "none", causing the permission list to fail open
if only one permission was specified. bz3515
* ssh(1): if the CanonicalizeHostname and CanonicalizePermittedCNAMEs
options were enabled, and the system/libc resolver did not check
that names in DNS responses were valid, then use of these options
could allow an attacker with control of DNS to include invalid
characters (possibly including wildcards) in names added to
known_hosts files when they were updated. These names would still
have to match the CanonicalizePermittedCNAMEs allow-list, so
practical exploitation appears unlikely.
Potentially-incompatible changes
--------------------------------
* ssh(1): add a new EnableEscapeCommandline ssh_config(5) option that
controls whether the client-side ~C escape sequence that provides a
command-line is available. Among other things, the ~C command-line
could be used to add additional port-forwards at runtime.
This option defaults to "no", disabling the ~C command-line that
was previously enabled by default. Turning off the command-line
allows platforms that support sandboxing of the ssh(1) client
(currently only OpenBSD) to use a stricter default sandbox policy.
New features
------------
* sshd(8): add support for channel inactivity timeouts via a new
sshd_config(5) ChannelTimeout directive. This allows channels that
have not seen traffic in a configurable interval to be
automatically closed. Different timeouts may be applied to session,
X11, agent and TCP forwarding channels.
* sshd(8): add a sshd_config UnusedConnectionTimeout option to
terminate client connections that have no open channels for a
length of time. This complements the ChannelTimeout option above.
* sshd(8): add a -V (version) option to sshd like the ssh client has.
* ssh(1): add a "Host" line to the output of ssh -G showing the
original hostname argument. bz3343
* scp(1), sftp(1): add a -X option to both scp(1) and sftp(1) to
allow control over some SFTP protocol parameters: the copy buffer
length and the number of in-flight requests, both of which are used
during upload/download. Previously these could be controlled in
sftp(1) only. This makes them available in both SFTP protocol
clients using the same option character sequence.
* ssh-keyscan(1): allow scanning of complete CIDR address ranges,
e.g. "ssh-keyscan 192.168.0.0/24". If a CIDR range is passed, then
it will be expanded to all possible addresses in the range
including the all-0s and all-1s addresses. bz#976
* ssh(1): support dynamic remote port forwarding in escape
command-line's -R processing. bz#3499
Bugfixes
--------
* ssh(1): when restoring non-blocking mode to stdio fds, restore
exactly the flags that ssh started with and don't just clobber them
with zero, as this could also remove the append flag from the set.
bz3523
* ssh(1): avoid printf("%s", NULL) if using UserKnownHostsFile=none
and a hostkey in one of the system known hosts file changes.
* scp(1): switch scp from using pipes to a socket-pair for
communication with its ssh sub-processes, matching how sftp(1)
operates.
* sshd(8): clear signal mask early in main(); sshd may have been
started with one or more signals masked (sigprocmask(2) is not
cleared on fork/exec) and this could interfere with various things,
e.g. the login grace timer. Execution environments that fail to
clear the signal mask before running sshd are clearly broken, but
apparently they do exist.
* ssh(1): warn if no host keys for hostbased auth can be loaded.
* sshd(8): Add server debugging for hostbased auth that is queued and
sent to the client after successful authentication, but also logged
to assist in diagnosis of HostbasedAuthentication problems. bz3507
* ssh(1): document use of the IdentityFile option as being usable to
list public keys as well as private keys. GHPR352
* sshd(8): check for and disallow MaxStartups values less than or
equal to zero during config parsing, rather than failing later at
runtime. bz3489
* ssh-keygen(1): fix parsing of hex cert expiry times specified on
the command-line when acting as a CA.
* scp(1): when scp(1) is using the SFTP protocol for transport (the
default), better match scp/rcp's handling of globs that don't match
the globbed characters but do match literally (e.g. trying to
transfer a file named "foo.[1]"). Previously scp(1) in SFTP mode
would not match these pathnames but legacy scp/rcp mode would.
bz3488
* ssh-agent(1): document the "-O no-restrict-websafe" command-line
option.
* ssh(1): honour user's umask(2) if it is more restrictive then the
ssh default (022).
Portability
-----------
* sshd(8): allow writev(2) in the Linux seccomp sandbox. This seems
to be used by recent glibcs at least in some configurations during
error conditions. bz3512.
* sshd(8): simply handling of SSH_CONNECTION PAM env var, removing
global variable and checking the return value from pam_putenv.
bz3508
* sshd(8): disable SANDBOX_SECCOMP_FILTER_DEBUG that was mistakenly
enabled during the OpenSSH 9.1 release cycle.
* misc: update autotools and regenerate the config files using the
latest autotools
* all: use -fzero-call-used-regs=used on clang 15 instead of
-fzero-call-used-reg=all, as some versions of clang 15 have
miscompile code when it was enabled. bz3475
* sshd(8): defer PRNG seeding until after the initial closefrom(2)
call. PRNG seeding will initialize OpenSSL, and some engine
providers (e.g. Intel's QAT) will open descriptors for their own
use that closefrom(2) could clobber. bz3483
* misc: in the poll(2)/ppoll(2) compatibility code, avoid assuming
the layout of fd_set.
* sftp-server(8), ssh-agent(1): fix ptrace(2) disabling on older
FreeBSD kernels. Some versions do not support using id 0 to refer
to the current PID for procctl, so try again with getpid()
explicitly before failing.
* configure.ac: fix -Wstrict-prototypes in configure test code.
Clang 16 now warns on this and legacy prototypes will be removed
in C23. GHPR355
* configure.ac: fix setres*id checks to work with clang-16. glibc
has the prototypes for setresuid behind _GNU_SOURCE, and clang 16
will error out on implicit function definitions. bz3497
To generate a diff of this commit:
cvs rdiff -u -r1.274 -r1.275 pkgsrc/security/openssh/Makefile
cvs rdiff -u -r1.116 -r1.117 pkgsrc/security/openssh/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: pkgsrc/security/openssh/Makefile
diff -u pkgsrc/security/openssh/Makefile:1.274 pkgsrc/security/openssh/Makefile:1.275
--- pkgsrc/security/openssh/Makefile:1.274 Wed Oct 12 13:34:59 2022
+++ pkgsrc/security/openssh/Makefile Thu Feb 2 13:31:12 2023
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.274 2022/10/12 13:34:59 wiz Exp $
+# $NetBSD: Makefile,v 1.275 2023/02/02 13:31:12 wiz Exp $
-DISTNAME= openssh-9.1p1
-PKGNAME= ${DISTNAME:S/p1/.1/}
+DISTNAME= openssh-9.2p1
CATEGORIES= security
MASTER_SITES= ${MASTER_SITE_OPENBSD:=OpenSSH/portable/}
Index: pkgsrc/security/openssh/distinfo
diff -u pkgsrc/security/openssh/distinfo:1.116 pkgsrc/security/openssh/distinfo:1.117
--- pkgsrc/security/openssh/distinfo:1.116 Wed Oct 12 13:34:59 2022
+++ pkgsrc/security/openssh/distinfo Thu Feb 2 13:31:12 2023
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.116 2022/10/12 13:34:59 wiz Exp $
+$NetBSD: distinfo,v 1.117 2023/02/02 13:31:12 wiz Exp $
-BLAKE2s (openssh-9.1p1.tar.gz) = 092880195912ce2cad9be1b40c62b15333335b835b08bd50cafc61dc9274b480
-SHA512 (openssh-9.1p1.tar.gz) = a1f02c407f6b621b1d0817d1a0c9a6839b67e416c84f3b76c63003b119035b24c19a1564b22691d1152e1d2d55f4dc7eb1af2d2318751e431a99c4efa77edc70
-Size (openssh-9.1p1.tar.gz) = 1838747 bytes
+BLAKE2s (openssh-9.2p1.tar.gz) = 3405455825bc23f1f76375e259704e189f5fd697d3745d5ce68fc3a26581e4cc
+SHA512 (openssh-9.2p1.tar.gz) = c4b79ef3a05b96bfc477ffb31f734635bffd5be213ab58e043111c3232dbe999ff24665fa1069518237cffa5126ded0dda8984e1b8f098f4f09b8c1dae20e604
+Size (openssh-9.2p1.tar.gz) = 1852380 bytes
SHA1 (patch-Makefile.in) = 70d6ca9c803b6193d0e340cb0518936a00e57492
SHA1 (patch-clientloop.c) = 4e88fbd14db33f003eb93c30c682a017e102196e
SHA1 (patch-config.h.in) = 7d1050743da7264763254b57938775c546c3baa5
Home |
Main Index |
Thread Index |
Old Index