diff options
Diffstat (limited to 'debian/changelog')
-rw-r--r-- | debian/changelog | 113 |
1 files changed, 113 insertions, 0 deletions
diff --git a/debian/changelog b/debian/changelog index 627124b96..5a180a84c 100644 --- a/debian/changelog +++ b/debian/changelog | |||
@@ -1,3 +1,116 @@ | |||
1 | openssh (1:7.7p1-3) UNRELEASED; urgency=medium | ||
2 | |||
3 | [ Colin Watson ] | ||
4 | * Adjust git-dpm tagging configuration. | ||
5 | |||
6 | [ Juri Grabowski ] | ||
7 | * Add rescue.target with ssh support. | ||
8 | |||
9 | -- Colin Watson <cjwatson@debian.org> Sat, 16 Jun 2018 12:42:36 +0100 | ||
10 | |||
11 | openssh (1:7.7p1-2) unstable; urgency=medium | ||
12 | |||
13 | * Fix parsing of DebianBanner option (closes: #894730). | ||
14 | |||
15 | -- Colin Watson <cjwatson@debian.org> Wed, 04 Apr 2018 00:47:29 +0100 | ||
16 | |||
17 | openssh (1:7.7p1-1) unstable; urgency=medium | ||
18 | |||
19 | * New upstream release (https://www.openssh.com/txt/release-7.7): | ||
20 | - ssh(1)/sshd(8): Drop compatibility support for some very old SSH | ||
21 | implementations, including ssh.com <=2.* and OpenSSH <= 3.*. These | ||
22 | versions were all released in or before 2001 and predate the final SSH | ||
23 | RFCs. The support in question isn't necessary for RFC-compliant SSH | ||
24 | implementations. | ||
25 | - Add experimental support for PQC XMSS keys (Extended Hash-Based | ||
26 | Signatures). | ||
27 | - sshd(8): Add an "rdomain" criterion for the sshd_config Match keyword | ||
28 | to allow conditional configuration that depends on which routing | ||
29 | domain a connection was received on. | ||
30 | - sshd_config(5): Add an optional rdomain qualifier to the ListenAddress | ||
31 | directive to allow listening on different routing domains. | ||
32 | - sshd(8): Add "expiry-time" option for authorized_keys files to allow | ||
33 | for expiring keys. | ||
34 | - ssh(1): Add a BindInterface option to allow binding the outgoing | ||
35 | connection to an interface's address (basically a more usable | ||
36 | BindAddress; closes: #289592). | ||
37 | - ssh(1): Expose device allocated for tun/tap forwarding via a new %T | ||
38 | expansion for LocalCommand. This allows LocalCommand to be used to | ||
39 | prepare the interface. | ||
40 | - sshd(8): Expose the device allocated for tun/tap forwarding via a new | ||
41 | SSH_TUNNEL environment variable. This allows automatic setup of the | ||
42 | interface and surrounding network configuration automatically on the | ||
43 | server. | ||
44 | - ssh(1)/scp(1)/sftp(1): Add URI support to ssh, sftp and scp, e.g. | ||
45 | ssh://user@host or sftp://user@host/path. Additional connection | ||
46 | parameters described in draft-ietf-secsh-scp-sftp-ssh-uri-04 are not | ||
47 | implemented since the ssh fingerprint format in the draft uses the | ||
48 | deprecated MD5 hash with no way to specify any other algorithm. | ||
49 | - ssh-keygen(1): Allow certificate validity intervals that specify only | ||
50 | a start or stop time (instead of both or neither). | ||
51 | - sftp(1): Allow "cd" and "lcd" commands with no explicit path argument. | ||
52 | lcd will change to the local user's home directory as usual. cd will | ||
53 | change to the starting directory for session (because the protocol | ||
54 | offers no way to obtain the remote user's home directory). | ||
55 | - sshd(8): When doing a config test with sshd -T, only require the | ||
56 | attributes that are actually used in Match criteria rather than (an | ||
57 | incomplete list of) all criteria. | ||
58 | - ssh(1)/sshd(8): More strictly check signature types during key | ||
59 | exchange against what was negotiated. Prevents downgrade of RSA | ||
60 | signatures made with SHA-256/512 to SHA-1. | ||
61 | - sshd(8): Fix support for client that advertise a protocol version of | ||
62 | "1.99" (indicating that they are prepared to accept both SSHv1 and | ||
63 | SSHv2). This was broken in OpenSSH 7.6 during the removal of SSHv1 | ||
64 | support. | ||
65 | - ssh(1): Warn when the agent returns a ssh-rsa (SHA1) signature when a | ||
66 | rsa-sha2-256/512 signature was requested. This condition is possible | ||
67 | when an old or non-OpenSSH agent is in use. | ||
68 | - ssh-agent(1): Fix regression introduced in 7.6 that caused ssh-agent | ||
69 | to fatally exit if presented an invalid signature request message. | ||
70 | - sshd_config(5): Accept yes/no flag options case-insensitively, as has | ||
71 | been the case in ssh_config(5) for a long time (LP: #1656557). | ||
72 | - ssh(1): Improve error reporting for failures during connection. Under | ||
73 | some circumstances misleading errors were being shown. | ||
74 | - ssh-keyscan(1): Add -D option to allow printing of results directly in | ||
75 | SSHFP format. | ||
76 | - ssh(1): Compatibility fix for some servers that erroneously drop the | ||
77 | connection when the IUTF8 (RFC8160) option is sent. | ||
78 | - scp(1): Disable RemoteCommand and RequestTTY in the ssh session | ||
79 | started by scp (sftp was already doing this). | ||
80 | - ssh-keygen(1): Refuse to create a certificate with an unusable number | ||
81 | of principals. | ||
82 | - ssh-keygen(1): Fatally exit if ssh-keygen is unable to write all the | ||
83 | public key during key generation. Previously it would silently ignore | ||
84 | errors writing the comment and terminating newline. | ||
85 | - ssh(1): Do not modify hostname arguments that are addresses by | ||
86 | automatically forcing them to lower-case. Instead canonicalise them | ||
87 | jo resolve ambiguities (e.g. ::0001 => ::1) before they are matched | ||
88 | against known_hosts. | ||
89 | - ssh(1): Don't accept junk after "yes" or "no" responses to hostkey | ||
90 | prompts. | ||
91 | - sftp(1): Have sftp print a warning about shell cleanliness when | ||
92 | decoding the first packet fails, which is usually caused by shells | ||
93 | polluting stdout of non-interactive startups. | ||
94 | - ssh(1)/sshd(8): Switch timers in packet code from using wall-clock | ||
95 | time to monotonic time, allowing the packet layer to better function | ||
96 | over a clock step and avoiding possible integer overflows during | ||
97 | steps. | ||
98 | - sshd(8): Correctly detect MIPS ABI in use at configure time. Fixes | ||
99 | sandbox violations on some environments. | ||
100 | - Build and link with "retpoline" flags when available to mitigate the | ||
101 | "branch target injection" style (variant 2) of the Spectre | ||
102 | branch-prediction vulnerability. | ||
103 | |||
104 | -- Colin Watson <cjwatson@debian.org> Tue, 03 Apr 2018 12:40:24 +0100 | ||
105 | |||
106 | openssh (1:7.6p1-5) unstable; urgency=medium | ||
107 | |||
108 | * Explicitly build-depend on pkg-config, rather than implicitly | ||
109 | build-depending on it via libgtk-3-dev (thanks, Aurelien Jarno; closes: | ||
110 | #894558). | ||
111 | |||
112 | -- Colin Watson <cjwatson@debian.org> Sun, 01 Apr 2018 21:37:19 +0100 | ||
113 | |||
1 | openssh (1:7.6p1-4) unstable; urgency=medium | 114 | openssh (1:7.6p1-4) unstable; urgency=medium |
2 | 115 | ||
3 | * Move VCS to salsa.debian.org. | 116 | * Move VCS to salsa.debian.org. |