Article 4DDM6 OpenSSH 8.0 released

OpenSSH 8.0 released

by
jake
from LWN.net on (#4DDM6)
OpenSSH 8.0 has been released with a bunch of new features and some bug fixes, including one for a security problem:"This release contains mitigation for a weakness in the scp(1) tooland protocol (CVE-2019-6111): when copying files from a remote systemto a local directory, scp(1) did not verify that the filenames thatthe server sent matched those requested by the client. This couldallow a hostile server to create or clobber unexpected local fileswith attacker-controlled content.This release adds client-side checking that the filenames sent fromthe server match the command-line request,The scp protocol is outdated, inflexible and not readily fixed. Werecommend the use of more modern protocols like sftp and rsync forfile transfer instead."
External Content
Source RSS or Atom Feed
Feed Location http://lwn.net/headlines/rss
Feed Title LWN.net
Feed Link https://lwn.net/
Reply 0 comments