./security/libssh2, SSH2 protocol library

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]


Branch: CURRENT, Version: 1.9.0nb1, Package name: libssh2-1.9.0nb1, Maintainer: pkgsrc-users

libssh2 is a library implementing the SSH2 protocol, available under
the revised BSD license.


Required to run:
[security/openssl]

Required to build:
[pkgtools/cwrappers]

Master sites:

SHA1: 21e98282b103307a16792e5e2d4c99beaf0b3b9c
RMD160: eb3553a9b2c05d5b6a24159db8a1478f9aea3877
Filesize: 867.726 KB

Version history: (Expand)


CVS history: (Expand)


   2020-05-10 19:27:27 by Roland Illig | Files touched by this commit (1)
Log message:
security/libssh2: remove unknown configure options
   2020-03-12 18:46:22 by Thomas Klausner | Files touched by this commit (2)
Log message:
libssh2: add upstream bug report
   2020-03-12 18:28:10 by Thomas Klausner | Files touched by this commit (3)
Log message:
libssh2: fix unportable test(1) operator in Makefile.in

Skip check for Makefile.am.
   2020-01-18 22:51:16 by Jonathan Perkin | Files touched by this commit (1836)
Log message:
*: Recursive revision bump for openssl 1.1.1.
   2019-07-21 10:18:53 by Nia Alarie | Files touched by this commit (1)
Log message:
libssh2: Don't build examples, they're not installed anyway.
   2019-07-09 12:42:59 by Nia Alarie | Files touched by this commit (3) | Package updated
Log message:
libssh2: Update to 1.9.0

Changes:
- adds ECDSA keys and host key support when using OpenSSL
- adds ED25519 key and host key support when using OpenSSL 1.1.1
- adds OpenSSH style key file reading
- adds AES CTR mode support when using WinCNG
- adds PEM passphrase protected file support for Libgcrypt and WinCNG
- adds SHA256 hostkey fingerprint
- adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
- adds explicit zeroing of sensitive data in memory
- adds additional bounds checks to network buffer reads
- adds the ability to use the server default permissions when creating sftp \ 
directories
- adds support for building with OpenSSL no engine flag
- adds support for building with LibreSSL
- increased sftp packet size to 256k
- fixed oversized packet handling in sftp
- fixed building with OpenSSL 1.1
- fixed a possible crash if sftp stat gets an unexpected response
- fixed incorrect parsing of the KEX preference string value
- fixed conditional RSA and AES-CTR support
- fixed a small memory leak during the key exchange process
- fixed a possible memory leak of the ssh banner string
- fixed various small memory leaks in the backends
- fixed possible out of bounds read when parsing public keys from the server
- fixed possible out of bounds read when parsing invalid PEM files
- no longer null terminates the scp remote exec command
- now handle errors when diffie hellman key pair generation fails
- fixed compiling on Windows with the flag STDCALL=ON
- improved building instructions
- improved unit tests
   2019-04-01 16:21:14 by Thomas Klausner | Files touched by this commit (2) | Package updated
Log message:
libssh2: update to 1.8.2.

Version 1.8.2 (25 Mar 2019)

Daniel Stenberg (25 Mar 2019)
- RELEASE-NOTES: version 1.8.2

- [Will Cosgrove brought this change]

  moved MAX size declarations #330

- [Will Cosgrove brought this change]

  Fixed misapplied patch (#327)

  Fixes for user auth
   2019-03-25 23:52:16 by Thomas Klausner | Files touched by this commit (2) | Package updated
Log message:
libssh2: update to 1.8.1.

Version 1.8.1 (14 Mar 2019)

Will Cosgrove (14 Mar 2019)
- [Michael Buckley brought this change]

  More 1.8.0 security fixes (#316)

  * Defend against possible integer overflows in comp_method_zlib_decomp.

  * Defend against writing beyond the end of the payload in \ 
_libssh2_transport_read().

  * Sanitize padding_length - _libssh2_transport_read(). \ 
https://libssh2.org/CVE-2019-3861.html

  This prevents an underflow resulting in a potential out-of-bounds read if a \ 
server sends a too-large padding_length, possibly with malicious intent.

  * Prevent zero-byte allocation in sftp_packet_read() which could lead to an \ 
out-of-bounds read. https://libssh2.org/CVE-2019-3858.html

  * Check the length of data passed to sftp_packet_add() to prevent \ 
out-of-bounds reads.

  * Add a required_size parameter to sftp_packet_require et. al. to require \ 
callers of these functions to handle packets that are too short. \ 
https://libssh2.org/CVE-2019-3860.html

  * Additional length checks to prevent out-of-bounds reads and writes in \ 
_libssh2_packet_add(). https://libssh2.org/CVE-2019-3862.html

GitHub (14 Mar 2019)
- [Will Cosgrove brought this change]

  1.8 Security fixes (#314)

  * fixed possible integer overflow in packet_length

  CVE https://www.libssh2.org/CVE-2019-3861.html

  * fixed possible interger overflow with userauth_keyboard_interactive

  CVE https://www.libssh2.org/CVE-2019-3856.html

  * fixed possible out zero byte/incorrect bounds allocation

  CVE https://www.libssh2.org/CVE-2019-3857.html

  * bounds checks for response packets

  * fixed integer overflow in userauth_keyboard_interactive

  CVE https://www.libssh2.org/CVE-2019-3863.html