Copssh 4.9.0 contains OpenSSH 6.6p binaries.

Changes since OpenSSH 6.5

This is primarily a bugfix release.

Security:

* sshd(8): when using environment passing with a sshd_config(5) AcceptEnv pattern with a wildcard. OpenSSH prior to 6.6 could be tricked into accepting any enviornment variable that contains the characters before the wildcard character.

New / changed features:

* ssh(1), sshd(8): this release removes the J-PAKE authentication code. This code was experimental, never enabled and had been unmaintained for some time.

* ssh(1): when processing Match blocks, skip 'exec' clauses other clauses predicates failed to match.

* ssh(1): if hostname canonicalisation is enabled and results in the destination hostname being changed, then re-parse ssh_config(5) files using the new destination hostname. This gives 'Host' and 'Match' directives that use the expanded hostname a chance to be applied.

Bugfixes:

* ssh(1): avoid spurious "getsockname failed: Bad file descriptor" in ssh -W. bz#2200, debian#738692

* sshd(8): allow the shutdown(2) syscall in seccomp-bpf and systrace sandbox modes, as it is reachable if the connection is terminated during the pre-auth phase.

* ssh(1), sshd(8): fix unsigned overflow that in SSH protocol 1 bignum parsing. Minimum key length checks render this bug unexploitable to compromise SSH 1 sessions.

* sshd_config(5): clarify behaviour of a keyword that appears in multiple matching Match blocks. bz#2184

* ssh(1): avoid unnecessary hostname lookups when canonicalisation is disabled. bz#2205

* sshd(8): avoid sandbox violation crashes in GSSAPI code by caching the supported list of GSSAPI mechanism OIDs before entering the sandbox. bz#2107

* ssh(1): fix possible crashes in SOCKS4 parsing caused by assumption that the SOCKS username is nul-terminated.

* ssh(1): fix regression for UsePrivilegedPort=yes when BindAddress is not specified.

* ssh(1), sshd(8): fix memory leak in ECDSA signature verification.

* ssh(1): fix matching of 'Host' directives in ssh_config(5) files to be case-insensitive again (regression in 6.5).

Portable OpenSSH:

* sshd(8): don't fatal if the FreeBSD Capsicum is offered by the system headers and libc but is not supported by the kernel.

* Fix build using the HP-UX compiler.