SUSE-RU-2023:4192-1

Описание

This update for libssh2_org fixes the following issues:

• Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040]

Update to 1.11.0:

• Enhancements and bugfixes

  • Adds support for encrypt-then-mac (ETM) MACs
  • Adds support for AES-GCM crypto protocols
  • Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys
  • Adds support for RSA certificate authentication
  • Adds FIDO support with *_sk() functions
  • Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends
  • Adds Agent Forwarding and libssh2_agent_sign()
  • Adds support for Channel Signal message libssh2_channel_signal_ex()
  • Adds support to get the user auth banner message libssh2_userauth_banner()
  • Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options
  • Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex()
  • Adds wolfSSL support to CMake file
  • Adds mbedTLS 3.x support
  • Adds LibreSSL 3.5 support
  • Adds support for CMake 'unity' builds
  • Adds CMake support for building shared and static libs in a single pass
  • Adds symbol hiding support to CMake
  • Adds support for libssh2.rc for all build tools
  • Adds .zip, .tar.xz and .tar.bz2 release tarballs
  • Enables ed25519 key support for LibreSSL 3.7.0 or higher
  • Improves OpenSSL 1.1 and 3 compatibility
  • Now requires OpenSSL 1.0.2 or newer
  • Now requires CMake 3.1 or newer
  • SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs
  • SFTP: No longer has a packet limit when reading a directory
  • SFTP: now parses attribute extensions if they exist
  • SFTP: no longer will busy loop if SFTP fails to initialize
  • SFTP: now clear various errors as expected
  • SFTP: no longer skips files if the line buffer is too small
  • SCP: add option to not quote paths
  • SCP: Enables 64-bit offset support unconditionally
  • Now skips leading \r and \n characters in banner_receive()
  • Enables secure memory zeroing with all build tools on all platforms
  • No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive
  • Speed up base64 encoding by 7x
  • Assert if there is an attempt to write a value that is too large
  • WinCNG: fix memory leak in _libssh2_dh_secret()
  • Added protection against possible null pointer dereferences
  • Agent now handles overly large comment lengths
  • Now ensure KEX replies don't include extra bytes
  • Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER
  • Fixed possible buffer overflow in keyboard interactive code path
  • Fixed overlapping memcpy()
  • Fixed Windows UWP builds
  • Fixed DLL import name
  • Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows
  • Support for building with gcc versions older than 8
  • Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files
  • Restores ANSI C89 compliance
  • Enabled new compiler warnings and fixed/silenced them
  • Improved error messages
  • Now uses CIFuzz
  • Numerous minor code improvements
  • Improvements to CI builds
  • Improvements to unit tests
  • Improvements to doc files
  • Improvements to example files
  • Removed 'old gex' build option
  • Removed no-encryption/no-mac builds
  • Removed support for NetWare and Watcom wmake build files

• Bump to version 1.10.0

  • Enhancements and bugfixes:

    • support ECDSA certificate authentication
    • fix detailed _libssh2_error being overwritten by generic errors
    • unified error handling
    • fix _libssh2_random() silently discarding errors
    • don't error if using keys without RSA
    • avoid OpenSSL latent error in FIPS mode
    • fix EVP_Cipher interface change in openssl 3
    • fix potential overwrite of buffer when reading stdout of command
    • use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data
    • correct a typo which may lead to stack overflow
    • fix random big number generation to match openssl
    • added key exchange group16-sha512 and group18-sha512.
    • add support for an OSS Fuzzer fuzzing target
    • adds support for ECDSA for both key exchange and host key algorithms
    • clean up curve25519 code
    • update the min, preferred and max DH group values based on RFC 8270.
    • changed type of LIBSSH2_FX_* constants to unsigned long
    • added diffie-hellman-group14-sha256 kex
    • fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression
    • fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x.
    • fixes crash with delayed compression option using Bitvise server.
    • adds support for PKIX key reading
    • use new API to parse data in packet_x11_open() for better bounds checking.
    • double the static buffer size when reading and writing known hosts
    • improved bounds checking in packet_queue_listener
    • improve message parsing (CVE-2019-17498)
    • improve bounds checking in kex_agree_methods()
    • adding SSH agent forwarding.
    • fix agent forwarding message, updated example.
    • added integration test code and cmake target. Added example to cmake list.
    • don't call libssh2_crypto_exit() until _libssh2_initialized count is down to zero.
    • add an EWOULDBLOCK check for better portability
    • fix off by one error when loading public keys with no id
    • fix use-after-free crash on reinitialization of openssl backend
    • preserve error info from agent_list_identities()
    • make sure the error code is set in _libssh2_channel_open()
    • fixed misspellings
    • fix potential typecast error for _libssh2_ecdsa_key_get_curve_type
    • rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type