2005-08-24 11:13:24 +02:00
|
|
|
$NetBSD: distinfo,v 1.10 2005/08/24 09:13:24 kivinen Exp $
|
2002-08-06 02:48:09 +02:00
|
|
|
|
Update to version 3.2.9.1.
While here bl3ify.
Changes since previously packaged version (3.2.5):
2003-12-03 Sami J. Lehtinen <sjl@ssh.com>
* ssh-3.2.9.1.
* non-commercial: removed cert hash compat stuff, which broke
compilation.
2003-09-26 Sami J. Lehtinen <sjl@ssh.com>
* ssh-3.2.9.
* ssh2,sshd2: (by Patrick Irwin): Critical security fix: fixed
several bugs in ASN.1 decoding functionality, which were caused
by invalid assumptions on the format of input BER data.
Certificates malformed in certain ways could cause a crash or
buffer overflow. No known exploits at this time, but you are
strongly advised to upgrade.
Admins unwilling or unable to upgrade need to disable
certificates, but this may not be enough for "hostbased"
authentication. "publickey" auth should be safe even with the
old version with certificates disabled. Clients are probably
vulnerable against malicious servers in the initial key exchange
regardless of configuration.
Users of noncommercial version are not affected by this
vulnerability.
2003-09-25 Sami J. Lehtinen <sjl@ssh.com>
* sshd2, ssh2: Implemented DisableVersionFallback, with which you
can disable fallback compatibility code for older, or otherwise
incompatible versions of software. Don't disable unless you know
what you're doing. See sshd2_config(5) for details. For really
paranoid people (using this option will probably hurt usability
somewhat, especially in environments where multiple versions of
SSH are used from different vendors).
* sshd2, ssh2: Implemented Cert.RSA.Compat.HashScheme. Older SSH
Secure Shell clients and servers used hashes in an incoherent
manner (sometimes MD5, sometimes SHA-1). With this option, you
can set what hash is used. See sshd2_config(5) for details.
* Previous: ssh-3.2.8.
2003-08-07 Tomi Salo <ttsalo@ssh.com>
* Added a new general configuration option, MaxCRLSize. This sets
the maximum size for CRLs and CA certs used in validating
received certificates. (The size is the total size of all CRLs
and certs, not the maximum individual size.)
2003-06-11 Sami J. Lehtinen <sjl@ssh.com>
* ssh-3.2.7.
* ssh-signer2: Fixed a bug, which caused the application to
intermittently call fatal because the read() operation was
interrupted by a signal (SIGCHLD).
2003-06-04 Sami J. Lehtinen <sjl@ssh.com>
* ssh-3.2.6.
* SecurID certified binaries, no code changes.
2004-03-12 17:40:08 +01:00
|
|
|
SHA1 (ssh-3.2.9.1.tar.gz) = 22e4589c889aef18e53a8942716084f0d8ede7db
|
2005-02-24 13:51:41 +01:00
|
|
|
RMD160 (ssh-3.2.9.1.tar.gz) = 21bfe97fae477dea1109c6e6eb44a448b6b2f250
|
Update to version 3.2.9.1.
While here bl3ify.
Changes since previously packaged version (3.2.5):
2003-12-03 Sami J. Lehtinen <sjl@ssh.com>
* ssh-3.2.9.1.
* non-commercial: removed cert hash compat stuff, which broke
compilation.
2003-09-26 Sami J. Lehtinen <sjl@ssh.com>
* ssh-3.2.9.
* ssh2,sshd2: (by Patrick Irwin): Critical security fix: fixed
several bugs in ASN.1 decoding functionality, which were caused
by invalid assumptions on the format of input BER data.
Certificates malformed in certain ways could cause a crash or
buffer overflow. No known exploits at this time, but you are
strongly advised to upgrade.
Admins unwilling or unable to upgrade need to disable
certificates, but this may not be enough for "hostbased"
authentication. "publickey" auth should be safe even with the
old version with certificates disabled. Clients are probably
vulnerable against malicious servers in the initial key exchange
regardless of configuration.
Users of noncommercial version are not affected by this
vulnerability.
2003-09-25 Sami J. Lehtinen <sjl@ssh.com>
* sshd2, ssh2: Implemented DisableVersionFallback, with which you
can disable fallback compatibility code for older, or otherwise
incompatible versions of software. Don't disable unless you know
what you're doing. See sshd2_config(5) for details. For really
paranoid people (using this option will probably hurt usability
somewhat, especially in environments where multiple versions of
SSH are used from different vendors).
* sshd2, ssh2: Implemented Cert.RSA.Compat.HashScheme. Older SSH
Secure Shell clients and servers used hashes in an incoherent
manner (sometimes MD5, sometimes SHA-1). With this option, you
can set what hash is used. See sshd2_config(5) for details.
* Previous: ssh-3.2.8.
2003-08-07 Tomi Salo <ttsalo@ssh.com>
* Added a new general configuration option, MaxCRLSize. This sets
the maximum size for CRLs and CA certs used in validating
received certificates. (The size is the total size of all CRLs
and certs, not the maximum individual size.)
2003-06-11 Sami J. Lehtinen <sjl@ssh.com>
* ssh-3.2.7.
* ssh-signer2: Fixed a bug, which caused the application to
intermittently call fatal because the read() operation was
interrupted by a signal (SIGCHLD).
2003-06-04 Sami J. Lehtinen <sjl@ssh.com>
* ssh-3.2.6.
* SecurID certified binaries, no code changes.
2004-03-12 17:40:08 +01:00
|
|
|
Size (ssh-3.2.9.1.tar.gz) = 2269281 bytes
|
Update to version 3.2.5
Previous versions have a security issue. Please update!
Thanks to gendalia@ for testing.
Changes since version 3.2.2:
2003-05-09 Sami J. Lehtinen <sjl@ssh.com>
* ssh-3.2.5.
* Fixed a critical security bug with RSA signature
verification. Mitigating factors: DSA is used by default (not
vulnerable). Also, the attack requires that attacker has the
public key and the attacker needs to precompute the signature
data so, that it looks like a valid PKCS#1 signature. This is a
non-trivial task to perform without the private
key. Nonetheless, all users should update their servers and
clients as soon as convenient. Workarounds are to not use RSA
keys as host keys (though connecting to existing hosts with RSA
hostkeys poses a serious risk with a vulnerable client), and
disabling publickey authentication. Update your clients and
servers.
2003-04-22 Sami J. Lehtinen <sjl@ssh.com>
* ssh-3.2.4.
* sshd2: Binary (generated by us) is tagged as a "supported
binary" for SecurID. (no actual code changes)
* Previous: ssh-3.2.3.1.
2003-02-06 Sami J. Lehtinen <sjl@ssh.com>
* sftp2 (etc): Fixed a bug with readline jamming when pressing
backspace (etc) on AIX and some other platforms.
2003-01-12 Sami J. Lehtinen <sjl@ssh.com>
* ssh-3.2.3.
2003-01-03 Sami J. Lehtinen <sjl@ssh.com>
* scp2: Removed broken special handling for SIGHUP, so that
"nohup" can again work.
* ssh2: Check whether we should ignore SIGQUIT, SIGINT, and do so,
if necessary. Thanks for J. Schilling for pointing this one out.
* ssh-add2: Make sure fgets() from pipe to ssh-askpass2 recovers
from if interrupted by signal, i.e. SIGCHLD.
* ssh2 (lib/sshsession/sshtty.c): As entry above, but for tcsetattr().
* During "make install", use default size of key instead of hardcoded
1024 when generating hostkey.
2002-12-18 Sami J. Lehtinen <sjl@ssh.com>
* scp2,sftp2: Print progress output to stdout, to make it
distinguishable from errors in cron jobs etc.
2002-12-17 Sami J. Lehtinen <sjl@ssh.com>
* apps/ssh/sshchsession.c: Fixed a bug which caused sshd2 child
server to jam occasionally after logging an event, if nsswitch had
been configured to use LDAP.
2002-12-13 Sami J. Lehtinen <sjl@ssh.com>
* sshd2: Previous (by Tomi Mickelsson): Fixed a bug where
specifying a local forwarding endpoint as an IP-address which was
unresolvable would result in a crash.
2002-12-12 Sami J. Lehtinen <sjl@ssh.com>
* scp2: Fixed a bug/missing feature from scp2. It now reports
information also when run when there is no tty. Also implemented
--statistics=[no,yes,simple], where "yes" is old-style, "no" is
analogous to "-Q" command-line option, and "simple" is the way
the statistics are printed when there is no tty (no intermittent
reporting, file size, transfer time and full file name are printed
after the transfer for the specific file is finished).
2002-12-11 Sami J. Lehtinen <sjl@ssh.com>
* ssh-keygen2: respect "-P" and "-p" options when converting
ssh1-keys.
2002-12-10 Sami J. Lehtinen <sjl@ssh.com>
* lib/sshutil/sshcore/sshdebug.c: Fixed a compilation problem
manifested on older AIX and debugging enabled (as is default).
* scp2: You can now specify the newline convention when using the
"-a" option. See manual page scp2(1).
2002-11-08 Sami J. Lehtinen <sjl@ssh.com>
* Removed ssh-pubkeymgr and ssh-chrootmgr from the distribution
(they didn't work too well).
* apps/ssh/lib/sshproto/trcommon.c: Fixed a crash if hostkey
algorithms or kex-methods couldn't be negotiated.
2002-11-05 Sami J. Lehtinen <sjl@ssh.com>
* lib/sshapputil/sshuserfile.c: Changed to use
lib/sshsession/sigchld.c, instead of using wait() directly. This
fixes the bug where the number of connections would slowly rise to
the maximum when using MaxConnections and tcp-wrappers (it was a
race-condition).
* lib/sshsession/sigchld.c: Sigchld now keeps a list of recently
exited children. This fixes a race condition, where the child
process could exit before the mother process had registered a
handler for it.
* lib/sshsession: Fixed NetBSD 1.6 compilation. Also, NetBSD 1.6
supports openpty style ptys, so fixed check to actually detect
them on NetBSD. Don't use utmpx on NetBSD, as it doesn't seem to
work (at least not in the way we use it).
* lib/sshsession/sshunixuser.c: Make sure we have room for the
NULL pointer in the groups array.
* ssh2 (ssh1-emulation): Fixed a bug, which in some cases caused
an assertion failure later.
2002-10-29 Sami J. Lehtinen <sjl@ssh.com>
* configure: Added /usr/X11R6/bin and /usr/X11/bin to search PATH
for xauth to ease installation on pristine systems.
2002-10-22 Sami J. Lehtinen <sjl@ssh.com>
* lib/sshutil/sshnet/sshtcp.c: (by Tomi Ollila) Fixed a bug with
SOCKS handling.
2002-10-01 Sami J. Lehtinen <sjl@ssh.com>
* lib/sshutil/sshpacketstream/sshpacketwrapper.c: (by Tomi Kause)
Fixed a latent (in ssh2) bug, when writing to the stream from the
received_cb.
* lib/sshutil/sshnet/sshsocks.c: (by Tomi Ollila) Decode
ipv6-mapped-ipv4-addresses when doing SOCKS4, as SOCKS4 only
supports plain ipv4-addresses.
* scp2: Implemented --overwrite, which controls whether to
overwrite the destination file(s). Default is "yes",
i.e. to overwrite.
* scp2: Implemented interactive mode, i.e. you can make scp2
prompt you whether to overwrite an existing destination
file. Works by giving --interactive (-I) on the command-line.
2002-08-15 Sami J. Lehtinen <sjl@ssh.com>
* sshd2: Fixed a bug with originator-pat with ForwardACLs.
2002-08-02 Sami J. Lehtinen <sjl@ssh.com>
* scp2, sftp2: Fixed a bug, which caused file transfer to stall,
if trying to transfer a zero sized file with ascii transfer
(newline mangling).
2002-07-21 Sami J. Lehtinen <sjl@ssh.com>
* sftp2: Added option "S" and "r" to "ls" (for sorting by size and
reversing the sort order, respectively).
* sftp2: "ls" works much better now. Tab completion understand
directories (appends a '/', for easier directory traversal).
* sftp2, scp2: Extensive rewrite of SshFileCopy, and as a
consequence, of both scp2 and sftp2 core functionality.
2002-06-13 Sami J. Lehtinen <sjl@ssh.com>
* ssh2: Fixed a bug with one-shot forwarding.
2003-08-12 21:08:55 +02:00
|
|
|
SHA1 (patch-aa) = 34353e23d81916202216dc401e99f17b08f3d6fb
|
|
|
|
|
SHA1 (patch-ab) = 314e2e4165fb1d429297f235c9712ddc0d924865
|
2004-07-25 14:29:19 +02:00
|
|
|
SHA1 (patch-ac) = aa4269fa9defce5d71a5e09df5aa95621c2b281d
|
Update to version 3.2.5
Previous versions have a security issue. Please update!
Thanks to gendalia@ for testing.
Changes since version 3.2.2:
2003-05-09 Sami J. Lehtinen <sjl@ssh.com>
* ssh-3.2.5.
* Fixed a critical security bug with RSA signature
verification. Mitigating factors: DSA is used by default (not
vulnerable). Also, the attack requires that attacker has the
public key and the attacker needs to precompute the signature
data so, that it looks like a valid PKCS#1 signature. This is a
non-trivial task to perform without the private
key. Nonetheless, all users should update their servers and
clients as soon as convenient. Workarounds are to not use RSA
keys as host keys (though connecting to existing hosts with RSA
hostkeys poses a serious risk with a vulnerable client), and
disabling publickey authentication. Update your clients and
servers.
2003-04-22 Sami J. Lehtinen <sjl@ssh.com>
* ssh-3.2.4.
* sshd2: Binary (generated by us) is tagged as a "supported
binary" for SecurID. (no actual code changes)
* Previous: ssh-3.2.3.1.
2003-02-06 Sami J. Lehtinen <sjl@ssh.com>
* sftp2 (etc): Fixed a bug with readline jamming when pressing
backspace (etc) on AIX and some other platforms.
2003-01-12 Sami J. Lehtinen <sjl@ssh.com>
* ssh-3.2.3.
2003-01-03 Sami J. Lehtinen <sjl@ssh.com>
* scp2: Removed broken special handling for SIGHUP, so that
"nohup" can again work.
* ssh2: Check whether we should ignore SIGQUIT, SIGINT, and do so,
if necessary. Thanks for J. Schilling for pointing this one out.
* ssh-add2: Make sure fgets() from pipe to ssh-askpass2 recovers
from if interrupted by signal, i.e. SIGCHLD.
* ssh2 (lib/sshsession/sshtty.c): As entry above, but for tcsetattr().
* During "make install", use default size of key instead of hardcoded
1024 when generating hostkey.
2002-12-18 Sami J. Lehtinen <sjl@ssh.com>
* scp2,sftp2: Print progress output to stdout, to make it
distinguishable from errors in cron jobs etc.
2002-12-17 Sami J. Lehtinen <sjl@ssh.com>
* apps/ssh/sshchsession.c: Fixed a bug which caused sshd2 child
server to jam occasionally after logging an event, if nsswitch had
been configured to use LDAP.
2002-12-13 Sami J. Lehtinen <sjl@ssh.com>
* sshd2: Previous (by Tomi Mickelsson): Fixed a bug where
specifying a local forwarding endpoint as an IP-address which was
unresolvable would result in a crash.
2002-12-12 Sami J. Lehtinen <sjl@ssh.com>
* scp2: Fixed a bug/missing feature from scp2. It now reports
information also when run when there is no tty. Also implemented
--statistics=[no,yes,simple], where "yes" is old-style, "no" is
analogous to "-Q" command-line option, and "simple" is the way
the statistics are printed when there is no tty (no intermittent
reporting, file size, transfer time and full file name are printed
after the transfer for the specific file is finished).
2002-12-11 Sami J. Lehtinen <sjl@ssh.com>
* ssh-keygen2: respect "-P" and "-p" options when converting
ssh1-keys.
2002-12-10 Sami J. Lehtinen <sjl@ssh.com>
* lib/sshutil/sshcore/sshdebug.c: Fixed a compilation problem
manifested on older AIX and debugging enabled (as is default).
* scp2: You can now specify the newline convention when using the
"-a" option. See manual page scp2(1).
2002-11-08 Sami J. Lehtinen <sjl@ssh.com>
* Removed ssh-pubkeymgr and ssh-chrootmgr from the distribution
(they didn't work too well).
* apps/ssh/lib/sshproto/trcommon.c: Fixed a crash if hostkey
algorithms or kex-methods couldn't be negotiated.
2002-11-05 Sami J. Lehtinen <sjl@ssh.com>
* lib/sshapputil/sshuserfile.c: Changed to use
lib/sshsession/sigchld.c, instead of using wait() directly. This
fixes the bug where the number of connections would slowly rise to
the maximum when using MaxConnections and tcp-wrappers (it was a
race-condition).
* lib/sshsession/sigchld.c: Sigchld now keeps a list of recently
exited children. This fixes a race condition, where the child
process could exit before the mother process had registered a
handler for it.
* lib/sshsession: Fixed NetBSD 1.6 compilation. Also, NetBSD 1.6
supports openpty style ptys, so fixed check to actually detect
them on NetBSD. Don't use utmpx on NetBSD, as it doesn't seem to
work (at least not in the way we use it).
* lib/sshsession/sshunixuser.c: Make sure we have room for the
NULL pointer in the groups array.
* ssh2 (ssh1-emulation): Fixed a bug, which in some cases caused
an assertion failure later.
2002-10-29 Sami J. Lehtinen <sjl@ssh.com>
* configure: Added /usr/X11R6/bin and /usr/X11/bin to search PATH
for xauth to ease installation on pristine systems.
2002-10-22 Sami J. Lehtinen <sjl@ssh.com>
* lib/sshutil/sshnet/sshtcp.c: (by Tomi Ollila) Fixed a bug with
SOCKS handling.
2002-10-01 Sami J. Lehtinen <sjl@ssh.com>
* lib/sshutil/sshpacketstream/sshpacketwrapper.c: (by Tomi Kause)
Fixed a latent (in ssh2) bug, when writing to the stream from the
received_cb.
* lib/sshutil/sshnet/sshsocks.c: (by Tomi Ollila) Decode
ipv6-mapped-ipv4-addresses when doing SOCKS4, as SOCKS4 only
supports plain ipv4-addresses.
* scp2: Implemented --overwrite, which controls whether to
overwrite the destination file(s). Default is "yes",
i.e. to overwrite.
* scp2: Implemented interactive mode, i.e. you can make scp2
prompt you whether to overwrite an existing destination
file. Works by giving --interactive (-I) on the command-line.
2002-08-15 Sami J. Lehtinen <sjl@ssh.com>
* sshd2: Fixed a bug with originator-pat with ForwardACLs.
2002-08-02 Sami J. Lehtinen <sjl@ssh.com>
* scp2, sftp2: Fixed a bug, which caused file transfer to stall,
if trying to transfer a zero sized file with ascii transfer
(newline mangling).
2002-07-21 Sami J. Lehtinen <sjl@ssh.com>
* sftp2: Added option "S" and "r" to "ls" (for sorting by size and
reversing the sort order, respectively).
* sftp2: "ls" works much better now. Tab completion understand
directories (appends a '/', for easier directory traversal).
* sftp2, scp2: Extensive rewrite of SshFileCopy, and as a
consequence, of both scp2 and sftp2 core functionality.
2002-06-13 Sami J. Lehtinen <sjl@ssh.com>
* ssh2: Fixed a bug with one-shot forwarding.
2003-08-12 21:08:55 +02:00
|
|
|
SHA1 (patch-ad) = dcaaf5f545bd4650784dc6fd0dbcaae48cf3f9d3
|
|
|
|
|
SHA1 (patch-ae) = 0d1f358bd97290118002cc0fc489cbf7e334e681
|
|
|
|
|
SHA1 (patch-af) = e7c956b858d02dfaf20e1fe1bfc36322d9eb6d67
|
|
|
|
|
SHA1 (patch-ag) = 0f7a448875262e2536255ace27cf1a8f0c2a0517
|
2004-05-28 14:00:10 +02:00
|
|
|
SHA1 (patch-ah) = dc9a496187907e34c602a9f99a65f8fe8a83c54e
|
2005-08-24 11:13:24 +02:00
|
|
|
SHA1 (patch-ai) = e5a21bc1c65877e2c2974d78bed16b52d2b486af
|
|
|
|
|
SHA1 (patch-aj) = 4190dff5f6fca937ff742233f8320b126428b51f
|
|
|
|
|
SHA1 (patch-ak) = dd7bc32a5b6cf4e8d8d5d35f46714ce21e52be1b
|
|
|
|
|
SHA1 (patch-al) = 401034768081c4181a92b9d9919ee6f6af9a8a5d
|
|
|
|
|
SHA1 (patch-am) = e0cb5d3f448570be653d8c039c310c3df909583d
|
|
|
|
|
SHA1 (patch-an) = 25a02df00dfe7484354316a87a30ce1144011f87
|
|
|
|
|
SHA1 (patch-ao) = c129f78b7e19843090ade11ae503f780a37921a4
|
|
|
|
|
SHA1 (patch-ap) = 3a7b34777734caf696f9c564f7de431597ff18f6
|
