On Thu, Jan 18, 2024 at 11:21 AM Guillaume Nodet <gno...@apache.org> wrote:
> The Apache Mina PMC is proud to announce the release of Mina SSHD 2.12.0. > > This new minor release provides a bunch of bug enhancements and bug > fixes, see the details at: > https://github.com/apache/mina-sshd/releases/tag/sshd-2.12.0 > > The release is available for download at > https://mina.apache.org/sshd-project/download_2.12.0.html Do you have an ETA when 2.12.0 will be deployed on Maven Central ? -Matthias # Introduced in 2.12.0 > > ## Bug Fixes > > * GH-428/GH-392 SCP client fails silently when error signalled due to > missing file or > lacking permissions > * GH-434 Ignore unknown key types from agent or in OpenSSH host keys > extension > > ## New Features > > * GH-429 Support GIT protocol-v2 > * GH-445 OpenSSH "strict key exchange" protocol extension (CVE-2023-48795 > mitigation) > > # Behavioral changes and enhancements > > ## New ScpTransferEventListener callback method > > Following GH-428/GH-392 a new handleReceiveCommandAckInfo method has > been added to enable users to inspect acknowledgements of a receive related > command. The user is free to inspect the command that was attempted as well > as the response code and decide how to handle it - including even throwing > an > exception if OK status (if this makes sense for whatever reason). The > default > implementation checks for ERROR code and throws an exception if so. > > ## OpenSSH protocol extension: strict key exchange > > GH-445 implements an extension to the SSH protocol introduced in OpenSSH > 9.6. This "strict key exchange" extension hardens the SSH key exchange > against > the "Terrapin attack" (CVE-2023-48795). The extension is active if both > parties > announce their support for it at the start of the initial key > exchange. If only one > party announces support, it is not activated to ensure compatibility with > SSH > implementations that do not implement it. Apache MINA sshd clients and > servers > always announce their support for strict key exchange. > > On behalf of the Maven Mina PMC team, > Guillaume Nodet > > --------------------------------------------------------------------- > To unsubscribe, e-mail: users-unsubscr...@mina.apache.org > For additional commands, e-mail: users-h...@mina.apache.org > >
