Skip to content

2024.2.0.5

Choose a tag to compare

View all tags
@darinkes darinkes released this 21 Jul 11:33
· 2 commits to main since this release
2024.2.0.5
3cb62ec

SSH.NET extension to authenticate via the OpenSSH agent and PuTTY Pageant.

A hardening-focused release on top of 2024.2.0.4, adding smartcard support and bounding every synchronous transport path.

Features

  • PKCS#11 / smartcard keys — add and remove keys held on a PKCS#11 token through the agent (ssh-add -s / -e): implements SSH_AGENTC_ADD_SMARTCARD_KEY, ..._ADD_SMARTCARD_KEY_CONSTRAINED and ..._REMOVE_SMARTCARD_KEY, sync and async, with the same lifetime/confirm constraints as regular keys.
  • sk certificate identities — FIDO / security-key identities that also carry an OpenSSH certificate (sk-*-cert-v01@openssh.com).

Hardening

  • Synchronous response length is now bounded — the sync receive path reads the whole framed response and applies OpenSSH's AGENT_MAX_MSGLEN cap (the async path already did), so a malformed or malicious length prefix is refused instead of driving an unbounded allocation.
  • Inner string lengths in agent messages are validated — length prefixes that overrun the message are rejected.
  • Legacy Pageant WM_COPYDATA transport is bounded — the 8 KB shared-memory fallback path.
  • Synchronous unix-socket connect is bounded — a stalled connect fails fast instead of hanging (covered by a regression test).
  • Invalid pipe names are tolerated when locating Pageant's OpenSSH named pipe.

Packaging / CI / Docs

  • Documented minting certificates with SshNet.Keygen (pairs with SshNet.Keygen 2024.2.0.4).
  • Dependabot: actions/setup-dotnet 5 → 6 and a nuget minor/patch group bump.

NuGet: https://www.nuget.org/packages/SshNet.Agent/2024.2.0.5

Full changelog: 2024.2.0.4...2024.2.0.5

Assets 2
Loading