Changelog for libssh2-1-debuginfo-1.11.1-1.1.i586.rpm :

* Tue Oct 22 2024 Pedro Monreal - Update to 1.11.1:
* build: enable \'-pedantic-errors\'
* build: add \'LIBSSH2_NO_DEPRECATED\' option
* build: stop requiring libssl from openssl
* disable DSA by default
* hostkey: do not advertise ssh-rsa when SHA1 is disabled
* kex: prevent possible double free of hostkey
* kex: always check for null pointers before calling _libssh2_bn_set_word
* kex: fix a memory leak in key exchange
* kex: always add extension indicators to kex_algorithms
* md5: allow disabling old-style encrypted private keys at build-time
* openssl: free allocated resources when using openssl3
* openssl: fix memory leaks in \'_libssh2_ecdsa_curve_name_with_octal_new\' and \'_libssh2_ecdsa_verify\'
* openssl: fix calculating DSA public key with OpenSSL 3
* openssl: initialize BIGNUMs to NULL in \'gen_publickey_from_dsa\' for OpenSSL 3
* openssl: fix cppcheck found NULL dereferences
* openssl: delete internal \'read_openssh_private_key_from_memory()\'
* openssl: use OpenSSL 3 HMAC API, add \'no-deprecated\' CI job
* openssl: make a function static, add \'#ifdef\' comments
* openssl: fix DSA code to use OpenSSL 3 API
* openssl: fix \'EC_KEY\' reference with OpenSSL 3 \'no-deprecated\' build
* openssl: use non-deprecated APIs with OpenSSL 3.x
* openssl: silence \'-Wunused-value\' warnings
* openssl: add missing check for \'LIBRESSL_VERSION_NUMBER\' before use
* packet: properly bounds check packet_authagent_open()
* pem: fix private keys encrypted with AES-GCM methods
* reuse: provide SPDX identifiers
* scp: fix missing cast for targets without large file support
* session: support server banners up to 8192 bytes
* session: add \'libssh2_session_callback_set2()\'
* session: handle EINTR from send/recv/poll/select to try again as the error is not fatal
* sftp: increase SFTP_HANDLE_MAXLEN back to 4092
* sftp: implement posix-renameAATTopenssh.com
* src: implement chacha20-poly1305AATTopenssh.com
* src: check the return value from \'_libssh2_bn_
*()\' functions
* src: support RSA-SHA2 cert-based authentication (rsa-sha2-512_cert and rsa-sha2-256_cert)
* src: check hash update/final success
* src: check hash init success
* src: add \'strict KEX\' to fix CVE-2023-48795 \"Terrapin Attack\"
* transport: fix unstable connections over non-blocking sockets
* transport: check ETM on remote end when receiving
* transport: fix incorrect byte offset in debug message
* userauth: avoid oob with huge interactive kbd response
* userauth: add a new structure to separate memory read and file read
* userauth: check whether \'
*key_method\' is a NULL pointer instead of \'key_method\'
* Rebase libssh2-ocloexec.patch
* Remove patches fixed upstream: - libssh2_org-CVE-2023-48795.patch - libssh2_org-CVE-2023-48795-ext.patch - libssh2_org-ETM-remote.patch
* Tue Apr 02 2024 Pedro Monreal - Fix an issue with Encrypt-then-MAC family. [bsc#1221622]
* Test the ETM feature in the remote end\'s configuration when receiving data. Upstream issue: #1331.
* Add libssh2_org-ETM-remote.patch
* Fri Feb 09 2024 Pedro Monreal - Always add the KEX pseudo-methods \"ext-info-c\" and \"kex-strict-c-v00AATTopenssh.com\" when configuring custom method list. [bsc#1218971, CVE-2023-48795]
* The strict-kex extension is announced in the list of available KEX methods. However, when the default KEX method list is modified or replaced, the extension is not added back automatically.
* Add libssh2_org-CVE-2023-48795-ext.patch
* Tue Dec 19 2023 Otto Hollmann - Security fix: [bsc#1218127, CVE-2023-48795]
* Add \'strict KEX\' to fix CVE-2023-48795 \"Terrapin Attack\"
* Add libssh2_org-CVE-2023-48795.patch
* Tue Jun 20 2023 Pedro Monreal - Update to 1.11.0:
* Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with
*_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake \"unity\" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \\r and \
characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don\'t include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed \"old gex\" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files
* Rebase libssh2-ocloexec.patch
* Fri Dec 10 2021 David Anes - Bump to version 1.10.0 Enhancements and bugfixes:
* support ECDSA certificate authentication
* fix detailed _libssh2_error being overwritten by generic errors
* unified error handling
* fix _libssh2_random() silently discarding errors
* don\'t error if using keys without RSA
* avoid OpenSSL latent error in FIPS mode
* fix EVP_Cipher interface change in openssl 3
* fix potential overwrite of buffer when reading stdout of command
* use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data
* correct a typo which may lead to stack overflow
* fix random big number generation to match openssl
* added key exchange group16-sha512 and group18-sha512.
* add support for an OSS Fuzzer fuzzing target
* adds support for ECDSA for both key exchange and host key algorithms
* clean up curve25519 code
* update the min, preferred and max DH group values based on RFC 8270.
* changed type of LIBSSH2_FX_
* constants to unsigned long
* added diffie-hellman-group14-sha256 kex
* fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression
* fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x.
* fixes crash with delayed compression option using Bitvise server.
* adds support for PKIX key reading
* use new API to parse data in packet_x11_open() for better bounds checking.
* double the static buffer size when reading and writing known hosts
* improved bounds checking in packet_queue_listener
* improve message parsing (CVE-2019-17498)
* improve bounds checking in kex_agree_methods()
* adding SSH agent forwarding.
* fix agent forwarding message, updated example.
* added integration test code and cmake target. Added example to cmake list.
* don\'t call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero.
* add an EWOULDBLOCK check for better portability
* fix off by one error when loading public keys with no id
* fix use-after-free crash on reinitialization of openssl backend
* preserve error info from agent_list_identities()
* make sure the error code is set in _libssh2_channel_open()
* fixed misspellings
* fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type`
* rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type- Rebased patch libssh2-ocloexec.path- Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version.
* Thu Aug 27 2020 Dominique Leuenberger - Drop man and groff BuildRequires: both are no longer used in current versions.
* Wed Oct 23 2019 Pedro Monreal Gonzalez - Security fix: [bsc#1154862, CVE-2019-17498]
* The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service
* Add patch libssh2_org-CVE-2019-17498.patch
* Thu Jun 20 2019 Pedro Monreal Gonzalez - Version update to 1.9.0: Enhancements and bugfixes:
* adds ECDSA keys and host key support when using OpenSSL
* adds ED25519 key and host key support when using OpenSSL 1.1.1
* adds OpenSSH style key file reading
* adds AES CTR mode support when using WinCNG
* adds PEM passphrase protected file support for Libgcrypt and WinCNG
* adds SHA256 hostkey fingerprint
* adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
* adds explicit zeroing of sensitive data in memory
* adds additional bounds checks to network buffer reads
* adds the ability to use the server default permissions when creating sftp directories
* adds support for building with OpenSSL no engine flag
* adds support for building with LibreSSL
* increased sftp packet size to 256k
* fixed oversized packet handling in sftp
* fixed building with OpenSSL 1.1
* fixed a possible crash if sftp stat gets an unexpected response
* fixed incorrect parsing of the KEX preference string value
* fixed conditional RSA and AES-CTR support
* fixed a small memory leak during the key exchange process
* fixed a possible memory leak of the ssh banner string
* fixed various small memory leaks in the backends
* fixed possible out of bounds read when parsing public keys from the server
* fixed possible out of bounds read when parsing invalid PEM files
* no longer null terminates the scp remote exec command
* now handle errors when diffie hellman key pair generation fails
* improved building instructions
* improved unit tests- Rebased patch libssh2-ocloexec.patch
* Tue Apr 09 2019 Pedro Monreal Gonzalez - Version update to 1.8.2: [bsc#1130103] Bug fixes:
* Fixed the misapplied userauth patch that broke 1.8.1
* moved the MAX size declarations from the public header