www/58.html - diff

Return to 58.html CVS log

Up to [local] / www

Diff for /www/58.html between version 1.26 and 1.27

-version 1.26, 2015/08/10 15:21:51
+version 1.27, 2015/08/10 19:44:09
 Line 162
 Line 162
 Line 162
      <ul>
      <li>Security:
        <ul>
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>:
+         when forwarding X11 connections with <tt>ForwardX11Trusted=no</tt>,
+         connections made after <tt>ForwardX11Timeout</tt> expired could be
+         permitted and no longer subject to XSECURITY restrictions because of
+         an ineffective timeout check in
+         <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>
+         coupled with "fail open" behaviour in the X11 server when clients
+         attempted connections with expired credentials.
+         This problem was reported by Jann Horn.
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-agent&amp;sektion=1">ssh-agent(1)</a>:
+         fix weakness of agent locking (<tt>ssh-add -x</tt>) to
+         password guessing by implementing an increasing failure delay,
+         storing a salted hash of the password rather than the password
+         itself and using a timing-safe comparison function for verifying
+         unlock attempts.  This problem was reported by Ryan Castellucci.
        <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
          OpenSSH 6.8 and 6.9 incorrectly set TTYs to be world-writable.
          Local attackers may be able to write arbitrary messages to logged-in
-Line 195
+Line 210
 Line 195
 Line 210
        </ul>
      <li>New/changed features:
        <ul>
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>,
+         <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
+         promote <tt>chacha20-poly1305@openssh.com</tt> to be the default
+         cipher.
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
+         support admin-specified arguments to <tt>AuthorizedKeysCommand</tt>.
+         (bz#2081)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
+         add <tt>AuthorizedPrincipalsCommand</tt> that allows retrieving
+         authorized principals information from a subprocess rather than a
+         file.
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>,
+         <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-add&amp;sektion=1">ssh-add(1)</a>:
+         support PKCS#11 devices with external PIN entry devices.  (bz#2240)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
+         allow GSSAPI host credential check to be relaxed for multihomed
+         hosts via <tt>GSSAPIStrictAcceptorCheck</tt> option.  (bz#928)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keygen&amp;sektion=1">ssh-keygen(1)</a>:
+         support <tt>ssh-keygen -lF hostname</tt> to search <tt>known_hosts</tt>
+         and print key hashes rather than full keys.
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-agent&amp;sektion=1">ssh-agent(1)</a>:
+         add <tt>-D</tt> flag to leave
+         <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-agent&amp;sektion=1">ssh-agent(1)</a>
+         in foreground without enabling debug mode.  (bz#2381)
        <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh_config&amp;sektion=5">ssh_config(5)</a>:
          add <tt>PubkeyAcceptedKeyTypes</tt> option to control which public
          key types are available for user authentication.
-Line 214
+Line 253
 Line 214
 Line 253
        <ul>
        <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>,
          <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
+         deprecate legacy <tt>SSH2_MSG_KEX_DH_GEX_REQUEST_OLD</tt> message and
+         do not try to use it against some 3rd-party SSH implementations that
+         use it (older PuTTY, WinSCP).
+       <li>Many fixes for problems caused by compile-time deactivation of
+         SSH1 support.  (including bz#2369)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>,
+         <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
+         cap DH-GEX group size at 4Kbits for Cisco implementations as some
+         would fail when attempting to use group sizes greater than 4K.
+         (bz#2209)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>:
+         fix out-of-bound read in <tt>EscapeChar</tt> configuration option
+         parsing.  (bz#2396)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
+         fix application of <tt>PermitTunnel</tt>, <tt>LoginGraceTime</tt>,
+         <tt>AuthenticationMethods</tt> and <tt>StreamLocalBindMask</tt>
+         options in <tt>Match</tt> blocks.
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>,
+         <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
+         improve disconnection message on TCP reset.  (bz#2257)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>:
+         remove failed remote forwards established by multiplexing from the
+         list of active forwards.  (bz#2363)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
+         make parsing of <tt>authorized_keys</tt> "<tt>environment=</tt>"
+         options independent of <tt>PermitUserEnv</tt> being enabled.  (bz#2329)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
+         fix post-auth crash with <tt>permitopen=none</tt>.  (bz#2355)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>,
+         <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-add&amp;sektion=1">ssh-add(1)</a>,
+         <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keygen&amp;sektion=1">ssh-keygen(1)</a>:
+         allow new-format private keys to be encrypted with AEAD ciphers.
+         (bz#2366)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>:
+         allow <tt>ListenAddress</tt>, <tt>Port</tt> and <tt>AddressFamily</tt>
+         configuration options to appear in any order.  (bz#86)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
+         check for and reject missing arguments for <tt>VersionAddendum</tt>
+         and <tt>ForceCommand</tt>.  (bz#2281)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>,
+         <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
+         don't treat unknown certificate extensions as fatal.  (bz#2387)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh-keygen&amp;sektion=1">ssh-keygen(1)</a>:
+         make <tt>stdout</tt> and <tt>stderr</tt> output consistent.  (bz#2325)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>:
+         mention missing <tt>DISPLAY</tt> environment in debug log when X11
+         forwarding requested.  (bz#1682)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
+         correctly record login when <tt>UseLogin</tt> is set.  (bz#378)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
+         add some missing options to <tt>sshd -T</tt> output and fix output
+         of <tt>VersionAddendum</tt> and <tt>HostCertificate</tt>.  (bz#2346)
+       <li>Document and improve consistency of options that accept a
+         "<tt>none</tt>" argument: <tt>TrustedUserCAKeys</tt>,
+         <tt>RevokedKeys</tt> (bz#2382), <tt>AuthorizedPrincipalsFile</tt>
+         (bz#2288).
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>:
+         include remote username in debug output.  (bz#2368)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
+         avoid compatibility problem with some versions of Tera Term, which
+         would crash when they received the hostkeys notification message
+         (<tt>hostkeys-00@openssh.com</tt>).
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
+         mention <tt>ssh-keygen -E</tt> as useful when comparing legacy
+         <i>MD5 host key fingerprints</i>.  (bz#2332)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>:
+         clarify pseudo-terminal request behaviour and use make manual language
+         consistent.  (bz#1716)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>:
+         document that the <tt>TERM</tt> environment variable is not subject
+         to <tt>SendEnv</tt> and <tt>AcceptEnv</tt>.  (bz#2386)
+       <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&amp;sektion=1">ssh(1)</a>,
+         <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&amp;sektion=8">sshd(8)</a>:
          add compatability workarounds for Cisco and more PuTTY versions.
          (bz#2424)
        <li>Fix some omissions and errors in the <tt>PROTOCOL</tt> and
-Line 242
+Line 354
 Line 242
 Line 354
      <ul>
      <li>User-visible features:
        <ul>
+       <li>Reject all <i>server DH keys</i> smaller than 1024 bits.
+       <li>Multiple CVEs fixed including CVE-2015-0207, CVE-2015-0209,
+         CVE-2015-0286, CVE-2015-0287, CVE-2015-0288, CVE-2015-0289,
+         CVE-2015-1788, CVE-2015-1789, CVE-2015-1792.
+       <li>Protocol parsing conversions to BoringSSL's <i>CRYPTO ByteString</i>
+         (CBS) API.
+       <li>Added <tt>EC_curve_nid2nist</tt> and <tt>EC_curve_nist2nid</tt>
+         from OpenSSL.
+       <li>Removed Dynamic Engine support.
+       <li>Removed MDC-2DES support.
        <li>Switched <tt>openssl dhparam</tt> default from 512 to 2048 bits.
-       <li>More <i>CRYPTO ByteString</i> (CBS) packet parsing conversions.
        <li>Fixed <tt>openssl pkeyutl -verify</tt> to exit with a 0 on success.
        <li>Fixed dozens of Coverity issues including dead code, memory leaks,
          logic errors and more.
-Line 271
+Line 392
 Line 271
 Line 392
        </ul>
      <li>Code improvements:
        <ul>
+       <li>Fix incorrect comparison function in openssl(1) certhash command.
+         Thanks to Christian Neukirchen / Void Linux.
+       <li>Removal of <tt>OPENSSL_issetugid</tt> and all library getenv calls.
+         Applications can and should no longer rely on environment variables
+         for changing library behavior.
+         <tt>OPENSSL_CONF</tt>/<tt>SSLEAY_CONF</tt> is still supported with the
+         <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=openssl&amp;sektion=1">openssl(1)</a>
+         command.
+       <li><tt>libtls</tt> API and documentation additions.
+       <li>rious bug fixes and simplifications to <tt>libssl</tt> and
+         <tt>libcrypto</tt>.
        <li>Reworked
          <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=openssl&amp;sektion=1">openssl(1)</a>
          option handling.