SUSE-SU-2024:0224-1: Security update for apache-parent, apache-sshd

This update for apache-parent, apache-sshd fixes the following issues: apache-parent was updated from version 28 to 31: Version 31: New Features: Added maven-checkstyle-plugin to pluginManagement

Improvements: Set minimalMavenBuildVersion to 3.6.3 - the minimum used by plugins Using an SPDX identifier as the license name is recommended by Maven Use properties to define the versions of plugins

Bugs fixed: Updated documentation for previous changes apache-sshd was updated from version 2.7.0 to 2.12.0: Security issues fixed: CVE-2023-48795: Implemented OpenSSH "strict key exchange" protocol in apache-sshd version 2.12.0 (bsc#1218189)

CVE-2022-45047: Java unsafe deserialization vulnerability fixed in apache-sshd version 2.9.2 (bsc#1205463)

Other changes in version 2.12.0:

Bugs fixed: SCP client fails silently when error signalled due to missing file or lacking permissions Ignore unknown key types from agent or in OpenSSH host keys extension

New Features: Support GIT protocol-v2

Other changes in version 2.11.0: Bugs fixed: Added configurable timeout(s) to DefaultSftpClient Compare file keys in ModifiableFileWatcher. Fixed channel pool in SftpFileSystem. Use correct default OpenOptions in SftpFileSystemProvider.newFileChannel(). Use correct lock modes for SFTP FileChannel.lock(). ScpClient: support issuing commands to a server that uses a non-UTF-8 locale. SftpInputStreamAsync: fix reporting EOF on zero-length reads. Work-around a bug in WSFTP <= 12.9 SFTP clients. (Regression in 2.10.0) SFTP performance fix: override FilterOutputStream.write(byte[], int, int). Fixed a race condition to ensure SSHMSGCHANNELEOF is always sent before SSHMSGCHANNELCLOSE. Fixed error handling while flushing queued packets at end of KEX. Fixed wrong log level on closing an Nio2Session. Fixed detection of Android O/S from system properties. Consider all applicable host keys from the knownhosts files. SftpFileSystem: do not close user session. ChannelAsyncOutputStream: remove write future when done. SSHD-1332 (Regression in 2.10.0) Resolve ~ in IdentityFile file names in HostConfigEntry.

New Features: Use KeepAliveHandler global request instance in client as well Publish snapshot maven artifacts to the Apache Snapshots maven repository. Bundle sshd-contrib has support classes for the HAProxy protocol V2.

Other changes in version 2.10.0: Bugs fixed: Connection attempt not canceled when a connection timeout occurs Possible OOM in ChannelPipedInputStream SftpRemotePathChannel.transferFrom(...) ignores position argument Rooted file system can leak informations Failed to establish an SSH connection because the server identifier exceeds the int range

Improvements: Password in clear in SSHD server's logs

Other changes in version 2.9.2: Bugs fixed: SFTP worker threads got stuck while processing PUT methods against one specific SFTP server Use the maximum packet size of the communication partner ExplicitPortForwardingTracker does not unbind auto-allocated one Default SshClient FD leak because Selector not closed Reading again from exhausted ChannelExec#getInvertedOut() throws IOException instead of returning -1 Keeping error streams and input streams separate after ChannelExec#setRedirectErrorStream(true) is called Nio2Session.shutdownOutput() should wait for writes in progress

Test: Research intermittent failure in unit tests using various I/O service factories

Other changes in version 2.9.1: Bugs fixed: ClientSession.auth().verify() is terminated with timeout 2.9.0 release broken on Java 8 Infinite loop in org.apache.sshd.sftp.client.impl.SftpInputStreamAsync#doRead Deadlock during session exit Race condition is logged in ChannelAsyncOutputStream

Other changes in version 2.9.0: Bugs fixed: Deadlock on disconnection at the end of key-exchange Remote port forwarding mode does not handle EOF properly Public key authentication: wrong signature algorithm used (ed25519 key with ssh-rsa signature) Client fails window adjust above Integer.MAXVALUE class loader fails to load org.apache.sshd.common.cipher.BaseGCMCipher Shell is not getting closed if the command has already closed the OutputStream it is using. Sometimes async write listener is not called Unhandled SSHMSGCHANNELWINDOWADJUST leeds to SocketTimeoutException different host key algorithm used on rekey than used for the initial connection OpenSSH certificate is not properly encoded when critical options are included TCP/IP remote port forwarding with wildcard IP addresses doesn't work with OpenSSH UserAuthPublicKey: uses ssh-rsa signatures for RSA keys from an agent

New Features: Added support for Argon2 encrypted PUTTY key files Added support for merged inverted output and error streams of remote process

Improvements: Added support for "limits@openssh.com" SFTP extension Support host-based pubkey authentication in the client Send environment variable and open subsystem at the same time for SSH session

Other changes in version 2.8.0: Bugs fixed: Fixed wrong server key algorithm choice Expiration of OpenSshCertificates needs to compare timestamps as unsigned long SFTP Get downloads empty file from servers which supports EOF indication after data skip() doesn't work properly in SftpInputStreamAsync OpenMode and CopyMode is not honored as expected in version > 4 of SFTP api SftpTransferTest sometimes hangs (failure during rekeying) Race condition in KEX Fix the ciphers supported documentation Update tarLongFileMode to use POSIX WinsCP transfer failure to Apache SSHD Server Pubkey auth: keys from ssh-agent are used even if HostConfigEntry.isIdentitiesOnly() is true Support RSA SHA2 signatures via SSH agent NOTICE: wrong copyright year range Wrong creationTime in writeAttrs for SFTP sshd-netty logs all traffic on INFO level

New Features: Add support for chacha20-poly1305@openssh.com Parsing of ~/.ssh/config Host patterns fails with extra whitespace Support generating OpenSSH client certificates

Improvements: Add support for curve25519-sha256@libssh.org key exchange OpenSSH certificates: check certificate type OpenSSHCertificatesTest: certificates expire in 2030 Display IdleTimeOut in more user-friendly format sendChunkIfRemoteWindowIsSmallerThanPacketSize flag in ChannelAsyncOutputStream constructor configurable from outside using variable/config file Intercepting the server exception message from server in SSHD client Implement RFC 8332 server-sig-algs on the server Slow performance listing huge number of files on Apache SSHD server SFTP: too many LSTAT calls Support key constraints when adding a key to an SSH agent Add SFTP server side file custom attributes hook