FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=releng%2F12.4 2023-02-16T17:12:39Z 2023-02-16T17:12:39Z Ed Maste emaste@FreeBSD.org 2023-02-06T16:26:08Z urn:sha1:e87e8c20e64753a25743d546e2a8b8619efd83c6 Approved by: so Security: FreeBSD-SA-23:02.openssh Security: CVE-2023-25136 Obtained from: OpenSSH-portable commit 12da78233364 Sponsored by: The FreeBSD Foundation (cherry picked from commit fe1371e8f3d7336748d291a7360b2aacce943fb1) (cherry picked from commit 296ec8eae0c834088a491643a937d881bfb4b5dd) (cherry picked from commit 2caac96a666ce99703b16e4d59a417bab8f91d3c) 2022-10-31T17:15:47Z Ed Maste emaste@FreeBSD.org 2022-10-19T14:27:11Z urn:sha1:50cb877af1fb6de40baa305dca93afdbd4de6568 Release notes are available at https://www.openssh.com/txt/release-9.1 9.1 contains fixes for three minor memory safety problems; these have lready been merged to the copy of OpenSSH 9.0 that is in the FreeBSD base system. Some highlights copied from the release notes: Potentially-incompatible changes -------------------------------- * ssh(1), sshd(8): SetEnv directives in ssh_config and sshd_config are now first-match-wins to match other directives. Previously if an environment variable was multiply specified the last set value would have been used. bz3438 * ssh-keygen(8): ssh-keygen -A (generate all default host key types) will no longer generate DSA keys, as these are insecure and have not been used by default for some years. New features ------------ * ssh(1), sshd(8): add a RequiredRSASize directive to set a minimum RSA key length. Keys below this length will be ignored for user authentication and for host authentication in sshd(8). * sftp-server(8): add a "users-groups-by-id@openssh.com" extension request that allows the client to obtain user/group names that correspond to a set of uids/gids. * sftp(1): use "users-groups-by-id@openssh.com" sftp-server extension (when available) to fill in user/group names for directory listings. * sftp-server(8): support the "home-directory" extension request defined in draft-ietf-secsh-filexfer-extensions-00. This overlaps a bit with the existing "expand-path@openssh.com", but some other clients support it. * ssh-keygen(1), sshd(8): allow certificate validity intervals, sshsig verification times and authorized_keys expiry-time options to accept dates in the UTC time zone in addition to the default of interpreting them in the system time zone. YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if suffixed with a 'Z' character. Also allow certificate validity intervals to be specified in raw seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This is intended for use by regress tests and other tools that call ssh-keygen as part of a CA workflow. bz3468 * sftp(1): allow arguments to the sftp -D option, e.g. sftp -D "/usr/libexec/sftp-server -el debug3" * ssh-keygen(1): allow the existing -U (use agent) flag to work with "-Y sign" operations, where it will be interpreted to require that the private keys is hosted in an agent; bz3429 MFC after: 2 weeks Relnotes: Yes Sponsored by: The FreeBSD Foundation (cherry picked from commit 38a52bd3b5cac3da6f7f6eef3dd050e6aa08ebb3) (cherry picked from commit ac5c465b9fdff74d1a73f63d157820887ff1787f) (cherry picked from commit 4aee71578a60981de9296451b7a995b180ae23db) Approved by: re (gjb) 2022-02-14T20:26:46Z Ed Maste emaste@FreeBSD.org 2021-12-19T16:02:02Z urn:sha1:273cf7f3b32b124c2b85d6ab30c3bfaa0bd7f2b9 OpenSSH v8.8p1 was motivated primarily by a security update and deprecation of RSA/SHA1 signatures. It also has a few minor bug fixes. The security update was already applied to FreeBSD as an independent change, and the RSA/SHA1 deprecation is excluded from this commit but will immediately follow. MFC after: 1 month Relnotes: Yes Sponsored by: The FreeBSD Foundation (cherry picked from commit e9e8876a4d6afc1ad5315faaa191b25121a813d7) (cherry picked from commit 2ffb13149c8e46cb7d7e891b237255615906dc60) (cherry picked from commit f40841ea9e70c8605dad4e8693fd6a8689b5e324) 2022-02-11T00:42:03Z Ed Maste emaste@FreeBSD.org 2021-09-08T01:05:51Z urn:sha1:bb83bdac03e92c8efcd991de8caccc5ec2ddcb20 Some notable changes, from upstream's release notes: - sshd(8): Remove support for obsolete "host/port" syntax. - ssh(1): When prompting whether to record a new host key, accept the key fingerprint as a synonym for "yes". - ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm. - ssh(1), sshd(8), ssh-keygen(1): this release removes the "ssh-rsa" (RSA/SHA1) algorithm from those accepted for certificate signatures. - ssh-sk-helper(8): this is a new binary. It is used by the FIDO/U2F support to provide address-space isolation for token middleware libraries (including the internal one). - ssh(1): this release enables UpdateHostkeys by default subject to some conservative preconditions. - scp(1): this release changes the behaviour of remote to remote copies (e.g. "scp host-a:/path host-b:") to transfer through the local host by default. - scp(1): experimental support for transfers using the SFTP protocol as a replacement for the venerable SCP/RCP protocol that it has traditionally used. Additional integration work is needed to support FIDO/U2F in the base system. Deprecation Notice ------------------ OpenSSH will disable the ssh-rsa signature scheme by default in the next release. Reviewed by: imp MFC after: 1 month Relnotes: Yes Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D29985 (cherry picked from commit 19261079b74319502c6ffa1249920079f0f69a72) (cherry picked from commit f448c3ed4ae1281861913a56377f9d93d49f8e8e) (cherry picked from commit 1f290c707a19d1695c303e6c8ead9cc414ccc6dc) (cherry picked from commit 0f9bafdfc325779e4ecc5154d5bb06c752297138) (cherry picked from commit adb56e58e8db84d8087ebe3d3e7def0074cb5a90) (cherry picked from commit 576b58108c1723c85e4dd00355e29bfe301dab11) (cherry picked from commit 1c99af1ebe61cbaf633792941640dcd254acf921) (cherry picked from commit 87152f34054921632016bc5eb4ab9f836fbaa522) (cherry picked from commit 172fa4aa7577915bf5ace5783251821d3774dc05) (cherry picked from commit 317a38ab65334cbd24bd020b20b11041423d142f) 2018-09-10T16:20:12Z Dag-Erling Smørgrav des@FreeBSD.org 2018-09-10T16:20:12Z urn:sha1:190cef3d52236565eb22e18b33e9e865ec634aa3 Approved by: re (kib@) 2018-05-11T13:22:43Z Dag-Erling Smørgrav des@FreeBSD.org 2018-05-11T13:22:43Z urn:sha1:47dd1d1b619cc035b82b49a91a25544309ff95ae 2018-05-08T23:13:11Z Dag-Erling Smørgrav des@FreeBSD.org 2018-05-08T23:13:11Z urn:sha1:4f52dfbb8d6c4d446500c5b097e3806ec219fbd4 This completely removes client-side support for the SSH 1 protocol, which was already disabled in 12 but is still enabled in 11. For that reason, we will not be able to merge 7.6p1 or newer back to 11. 2017-08-04T12:57:24Z Dag-Erling Smørgrav des@FreeBSD.org 2017-08-04T12:57:24Z urn:sha1:d93a896ef95946b0bf1219866fcb324b78543444 2017-03-02T00:11:32Z Dag-Erling Smørgrav des@FreeBSD.org 2017-03-02T00:11:32Z urn:sha1:076ad2f836d5f49dc1375f1677335a48fe0d4b82 2016-01-21T11:54:34Z Dag-Erling Smørgrav des@FreeBSD.org 2016-01-21T11:54:34Z urn:sha1:fc1ba28a5c70935b11b49532dc5eff88b382c107