Skip to content

20261101

Latest
Latest

Choose a tag to compare

View all tags
@janmojzis janmojzis released this 01 Nov 06:23
20261101
6a60c2a
This commit was signed with the committer’s verified signature.
janmojzis Jan Mojžíš
GPG key ID: 45DA517496939FF9
Verified
Learn about vigilant mode.

20261101

  • Extracted portable p_openpty() and p_login_tty() helpers from PTY session setup.

The following issues were discovered by Anthropic's OSS Scanner:

  • Detached non-PTY session commands from the supervisor's controlling terminal (ANT-2026-XXAAW4IN).
  • Restricted PTY permissions before changing ownership, using the open slave descriptor (ANT-2026-N0CYS4Q7).
  • Passed the remaining authentication timeout to the authorized_keys helper (ANT-2026-05XP1SBC).
  • Added portable p_closefrom (ANT-2026-6TL7702P).
  • Stopped retrying writes after PTY input hangup to prevent a busy loop (ANT-2026-C5CA7S93).
  • Checked the home and .ssh directory paths before following authorized_keys symlinks (ANT-2026-1X7WCZO8).
  • Rejected non-canonical public key encodings in bundled Ed25519 verification (ANT-2026-WLSFCCD8).
  • Rejected embedded NUL bytes in key-exchange algorithm name-lists (ANT-2026-C3S8DE78).
  • Preserved the original pre-authentication timeout through initial key exchange (ANT-2026-LAOMU7HO).
  • Ignored strict-KEX pseudo-algorithms during rekeying (ANT-2026-W96YNM9A).
  • Preserved the original connection addresses when starting a session after a TCP reset (ANT-2026-9WQBV5XI).
  • Enforced the unauthenticated message limit across strict-KEX sequence number resets (ANT-2026-J2GQ3C81).
  • Validated the expected NEWKEYS message before resetting the receive sequence number (ANT-2026-JG01TJVM).
  • Rejected unexpected packets while waiting for NEWKEYS in non-strict key exchange (ANT-2026-ENU881FU).
  • Rejected trailing bytes in NEWKEYS and unsigned public-key authentication queries (ANT-2026-XZ9G6LZF).
  • Charged discarded channel data to the receive window (ANT-2026-73WWMPXB).
  • Discarded input after EOF and stopped sending session output after channel close (ANT-2026-VVQSA6W4).
  • Emitted each log message as a single record, truncating oversized messages (ANT-2026-UZM1VY24).
  • Preserved the blocking mode of inherited standard error (ANT-2026-SJBW016C).
  • Rejected all-zero X25519 shared secrets in hybrid key exchange (ANT-2026-B39U58TI).
Assets 3
Loading