Changelog for
libssh2-1-32bit-1.4.3-19.3.1.x86_64.rpm :
Wed Mar 13 13:00:00 2019 Pedro Monreal Gonzalez
- Store but don\'t use keys of unsupported types in the known_hosts file [bsc#1091236]
* Added libssh2_org-knownhosts-handle-unknown-key-types.patch
Mon Mar 11 13:00:00 2019 Pedro Monreal Gonzalez
- Security fixes:
* [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport
read allows out-of-bounds write with specially crafted payload
- libssh2_org-CVE-2019-3855.patch
* [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard
interactive handling allows out-of-bounds write with specially
crafted payload
- libssh2_org-CVE-2019-3856.patch
* [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to
zero-byte allocation and out-of-bounds with specially crafted
message channel request SSH packet
- libssh2_org-CVE-2019-3857.patch
* [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading
to an out-of-bounds read with a specially crafted SFTP packet
- libssh2_org-CVE-2019-3858.patch
* [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially
crafted payloads due to unchecked use of _libssh2_packet_require
and _libssh2_packet_requirev
- libssh2_org-CVE-2019-3859.patch
* [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially
crafted SFTP packets
- libssh2_org-CVE-2019-3860.patch
* [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially
crafted SSH packets
- libssh2_org-CVE-2019-3861.patch
* [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with
specially crafted message channel request SSH packet
- libssh2_org-CVE-2019-3862.patch
* [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate
keyboard interactive allows out-of-bounds writes with specially
crafted keyboard responses
- libssh2_org-CVE-2019-3863.patch
Tue Apr 19 14:00:00 2016 pjanouchAATTsuse.de
- add bsc974691.patch (bsc#974691)
- fix 0001-kex-Added-diffie-hellman-group-exchange-sha256-suppo.patch
(as per CVE-2016-0787)
Tue Feb 23 13:00:00 2016 vcizekAATTsuse.com
- add SHA256 support for DH group exchange (fate#320343, bsc#961964)
* add patches:
0001-Add-support-for-HMAC-SHA-256-and-HMAC-SHA-512.patch
0001-kex-Added-diffie-hellman-group-exchange-sha256-suppo.patch
Mon Feb 22 13:00:00 2016 vcizekAATTsuse.com
- fix CVE-2016-0787 (bsc#967026)
* Weakness in diffie-hellman secret key generation
* add CVE-2016-0787.patch
Wed Jul 8 14:00:00 2015 vcizekAATTsuse.com
- properly detect EVP_aes_128_ctr at configure time (bsc#933336)
* added libssh2-configure_detect_aes_ctr.patch
Mon Mar 9 13:00:00 2015 vcizekAATTsuse.com
- fix for CVE-2015-1782 (bnc#921070)
* unbounded read when negotiating a new session
* added CVE-2015-1782.patch
Mon Jun 24 14:00:00 2013 mvyskocilAATTsuse.com
- ignore groff-full to remove factory build cycle
- add groff to build requires to make tests passing
Wed Apr 24 14:00:00 2013 borisAATTsteki.net
- fix building on older kernels and older OS / SLE
Thu Feb 28 13:00:00 2013 crrodriguezAATTopensuse.org
- Use AC_CONFIG_HEADERS instead of AM_CONFIG_HEADER, fixes
build with new automake
Tue Jan 8 13:00:00 2013 vcizekAATTsuse.com
- update to 1.4.3
compression: add support for zlibAATTopenssh.com
Bug fixes:
sftp_read: return error if a too large package arrives
libssh2_hostkey_hash.3: update the description of return value
examples: use stderr for messages, stdout for data
openssl: do not leak memory when handling errors
improved handling of disabled MD5 algorithm in OpenSSL
known_hosts: Fail when parsing unknown keys in known_hosts file
configure: gcrypt doesn\'t come with pkg-config support
session_free: wrong variable used for keeping state
libssh2_userauth_publickey_fromfile_ex.3: mention publickey == NULL
comp_method_zlib_decomp: handle Z_BUF_ERROR when inflating
Return LIBSSH2_ERROR_SOCKET_DISCONNECT on EOF when reading banner
userauth.c: fread() from public key file to correctly detect any errors
configure.ac: Add option to disable build of the example applications
Added \'Requires.private:\' line to libssh2.pc
SFTP: filter off incoming \"zombie\" responses
gettimeofday: no need for a replacement under cygwin
SSH_MSG_CHANNEL_REQUEST: default to want_reply
win32/libssh2_config.h: Remove hardcoded #define LIBSSH2_HAVE_ZLIB
build error with gcrypt backend
always do \"forced\" window updates to avoid corner case stalls
aes: the init function fails when OpenSSL has AES support
transport_send: Finish in-progress key exchange before sending data
channel_write: acknowledge transport errors
examples/x11.c: Make sure sizeof passed to read operation is correct
examples/x11.c:,Fix suspicious sizeof usage
sftp_packet_add: verify the packet before accepting it
SFTP: preserve the original error code more
sftp_packet_read: adjust window size as necessary
Use safer snprintf rather then sprintf in several places
Define and use LIBSSH2_INVALID_SOCKET instead of INVALID_SOCKET
sftp_write: cannot return acked data
*and
* EAGAIN
sftp_read: avoid data
*and
* EAGAIN
libssh2.h: Add missing prototype for libssh2_session_banner_set()
- dropped patches (already in the upstream)
0004-libssh2.h-Add-missing-prototype-for-libssh2_session_.patch
0005-Add-symbol-versioning.patch
0006-missing-libssh2_session_banner_set.patch
Thu Feb 2 13:00:00 2012 crrodriguezAATTopensuse.org
- fix license
Thu Feb 2 13:00:00 2012 crrodriguezAATTopensuse.org
- Update to version 1.4.0 plus git bugfixes
Tue Dec 27 13:00:00 2011 crrodriguezAATTopensuse.org
- Refresh patches.
Thu Dec 1 13:00:00 2011 jengelhAATTmedozas.de
- Remove redundant/unwanted tags/section (cf. specfile guidelines)
Thu Dec 1 13:00:00 2011 crrodriguezAATTopensuse.org
- open library file descriptors with O_CLOEXEC
Fri Oct 21 14:00:00 2011 crrodriguezAATTopensuse.org
- Update to version 1.3.0
* sftp_read: advance offset correctly for buffered copies
* libssh2_sftp_seek64: flush packetlist and buffered data
* _libssh2_packet_add: adjust window size when truncating
* sftp_read: a short read is not end of file
Sat Oct 1 14:00:00 2011 dmuellerAATTsuse.de
- document the reason for the testsuite failure
Fri Sep 30 14:00:00 2011 crrodriguezAATTopensuse.org
- Workaround qemu-arm problems.
Tue Sep 6 14:00:00 2011 crrodriguezAATTopensuse.org
- respect user\'s openssl.cnf engine configuration, might
want to do crypto with aes-ni, intel-accell or use rdrand
Wed Aug 17 14:00:00 2011 crrodriguezAATTopensuse.org
- Update to version 1.2.9
* Added libssh2_session_set_timeout() and
libssh2_session_get_timeout() to make blocking calls get a timeout
* userauth_keyboard_interactive: fix buffer overflow
Fri Oct 29 14:00:00 2010 cristian.rodriguezAATTopensuse.org
- Update 1.2.7
- Better handling of invalid key files
- inputchecks: make lots of API functions check for NULL pointers
- libssh2_session_callback_set: extended the man page
- SFTP: limit write() to not produce overly large packets
- agent: make libssh2_agent_userauth() work blocking properly
- _libssh2_userauth_publickey: reject method names longer than the data
- channel_free: ignore problems with channel_close()
- typedef: make ssize_t get typedef without LIBSSH2_WIN32
- _libssh2_wait_socket: poll needs milliseconds
- libssh2_wait_socket: reset error code to \"leak\" EAGAIN less
- Added include for sys/select.h to get fd.set on some platforms
- session_free: free more data to avoid memory leaks
- openssl: make use of the EVP interface
- Fix underscore typo for 64-bit printf format specifiers on Windows
- Make libssh2_debug() create a correctly terminated string
- userauth_hostbased_fromfile: packet length too short
- handshake: Compression enabled at the wrong time
- Don\'t overflow MD5 server hostkey-
Sun Aug 8 14:00:00 2010 cristian.rodriguezAATTopensuse.org
- restore %build section, accidentally removed
Mon Aug 2 14:00:00 2010 cristian.rodriguezAATTopensuse.org
- update to libssh2 1.2.6
* Added libssh2_sftp_statvfs() and libssh2_sftp_fstatvfs()
* Added libssh2_knownhost_checkp()
* Added libssh2_scp_send64()
* fail to init SFTP if session isn\'t already authenticated
* sftp_close_handle: add precaution to not access NULL pointer
* channel_write: if data has been sent, don\'t return EAGAIN
Tue Apr 6 14:00:00 2010 crrodriguezAATTopensuse.org
- fix build in older products
Mon Feb 22 13:00:00 2010 crrodriguezAATTopensuse.org
- update to version 1.2.4
Mon Feb 1 13:00:00 2010 jengelhAATTmedozas.de
- package baselibs.conf
Sat Nov 28 13:00:00 2009 crrodriguezAATTopensuse.org
- Update snapshot
Wed Sep 30 14:00:00 2009 crrodriguezAATTopensuse.org
- add visbility support
Wed Sep 30 14:00:00 2009 crrodriguezAATTopensuse.org
- update to version 1.2.1 see NEWS for details
Mon Aug 10 14:00:00 2009 crrodriguezAATTsuse.de
- update to version 1.2 see NEWS for details
Wed May 27 14:00:00 2009 crrodriguezAATTsuse.de
- do not provide or obsolete libssh2 [bnc#507444]
Sat May 9 14:00:00 2009 crrodriguezAATTsuse.de
- update to version 1.1, see NEWS for details
