After six months of development, the release of OpenSSH 10.3, the open implementation of the client and server for working with the SSH 2.0 and SFTP protocols. Main changes:
- A vulnerability has been fixed that allowed an attacker controlling the username passed when launching the ssh utility to potentially execute arbitrary shell commands. The vulnerability manifests in systems that use '%u' substitution in certain directives of the configuration file, such as 'Match exec'. The problem is caused by the check of special characters in the username occurring after the %-substitutions have been executed in the ssh_config file.
- A security issue in sshd has been resolved, caused by incorrect matching of the authorized_keys option principals="" with the list of names (principal) in the certificate when a comma (',') is present in the names. To exploit the vulnerability, it was necessary for multiple names to be specified in the authorized_keys option principals="" and for a certificate authority to issue a certificate with multiple names separated by a comma (which is usually not allowed). The behavior regarding certificates with an empty name has changed — previously, an empty name would fall under all authorized_keys principals="" options, but now it does not.
- In scp, a problem has been fixed where, after uploading a file with root permissions using the '-O' option and without the '-p' option, the setuid/setgid flags were not cleared.
- In sshd, an issue with processing ECDSA keys in the PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms directives has been corrected, whereby specifying any ECDSA algorithm (for example, 'ecdsa-sha2-nistp384') caused all other ECDSA-based algorithms to be accepted as well, even if they were not explicitly listed in the acceptable list.
- In ssh and sshd, support for identifiers (codepoints) defined by IANA in the draft-ietf-sshm-ssh-agent specification has been added when interacting with SSH agents. Support for previously used identifiers of the form '@openssh.com' has been retained.
- In ssh-agent, the 'query' extension defined in the draft-ietf-sshm-ssh-agent specification has been implemented, allowing the identification of the functions supported by the agent. To query the list of supported protocol extensions, the '-Q' option has been added to the ssh-add utility.
- In sshd_config, it is now allowed to specify multiple files in the RevokedKeys directive, and in ssh_config, in the RevokedHostKeys directive.
- In ssh, the escape command "~I" and the option "-O conninfo" have been added to display information about the current connection, as well as the option "-O channels" to show information about open channels.
- In sshd, the directive PerSourcePenalties has been implemented with the 'invaliduser' option to add a delay in case of an attempt to log in as a non-existent user (default is 5 seconds). It is now possible to specify non-integer delay values.
- In sshd, the GSSAPIDelegateCredentials option has been added to control the acceptance of delegated credentials provided by the client.
- In ssh-keygen, support for writing ED25519 keys in PKCS8 format has been added.
- Support for the ed25519 digital signature scheme has been implemented through libcrypto.
Source: opennet.ru
