Releases

Copssh version 6.1.2 comes with the latest version of LibreSSL (2.6.4). A predefined working directory (inst_directory\_work) is now used to unpack subinstallers and other installer tools, allowing anti malware/virus programs for exclusion in a deterministic way if necessary. Working directory will be removed upon a successful installation.

Copssh version 6.1.1 comes with the latest version LibreSSL (2.6.3). Upgrade logic in our installers are also improved.

Copssh version 6.1.0 comes with the latest versions of OpenSSH (7.6) and LibreSSL (2.5.5). We have also updated the Cygwin and GNU Tools to their latest available versions.

Security issue:

• sftp-server(8): in read-only mode, sftp-server was incorrectly permitting creation of zero-length files. Reported by Michal Zalewski.

Potentially-incompatible changes in OpenSSH:

This release includes a number of changes that may affect existing configurations:

• ssh(1): delete SSH protocol version 1 support, associated  configuration options and documentation.
• ssh(1)/sshd(8): remove support for the hmac-ripemd160 MAC.
• ssh(1)/sshd(8): remove support for the arcfour, blowfish and CAST ciphers.
• Refuse RSA keys <1024 bits in length and improve reporting for keys that do not meet this requirement.
• ssh(1): do not offer CBC ciphers by default.

Copssh version 6.0.0 is a major update and uses now LibreSSL instead of OpenSSL as the cryptographic library provider. 

LibreSSL is a version of the TLS/crypto stack forked from OpenSSL in 2014, with goals of modernizing the codebase, improving security, and applying best practice development processes. Primary development occurs inside the OpenBSD source tree with the usual care the project is known for. On a regular basis the code is re-packaged for portable use by other operating systems (Linux, FreeBSD, Windows, etc).

See https://en.wikipedia.org/wiki/LibreSSL for more detailed information.

We have also upgraded Cygwin and GNU tools to their latest available versions.

Copssh version 5.9.0 bundle contains latest versions of OpenSSH (7.5p1), OpenSSL (1.0.1k), Cygwin and GNU tools. Installers use now quoted service executable paths to avoid potential misuse of unquoted path vulnerabilities.

OpenSSH Security fixes:

• ssh(1), sshd(8): Fix weakness in CBC padding oracle countermeasures that allowed a variant of the attack fixed in OpenSSH 7.3 to proceed. Note that the OpenSSH client disables CBC ciphers by default, sshd offers them as lowest-preference options and will remove them by default entriely in the next release. Reported by Jean Paul Degabriele, Kenny Paterson, Martin Albrecht and Torben Hansen of Royal Holloway, University of London.
• sftp-client(1): [portable OpenSSH only] On Cygwin, a client making a recursive file transfer could be maniuplated by a hostile server to perform a path-traversal attack. creating or modifying files outside of the intended target directory. Reported by Jann Horn of Google Project Zero.

OpenSSL Security fixes:

• Truncated packet could crash via OOB read (CVE-2017-3731)
• BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
• Montgomery multiplication may produce incorrect results (CVE-2016-7055)