[openssh-commits] [openssh] branch master updated (b5b405fee -> e04823010)

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a change to branch master
in repository openssh.

    from b5b405fee Set Windows permssions on regress dir.
     new c991273c1 upstream: fix a out-of-bounds read if the known_hosts file is
     new e04823010 upstream: make writing known_hosts lines more atomic, by writing

The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Detailed log of new commits:

commit e048230106fb3f5e7cc07abc311c6feb5f52fd05
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Wed Apr 30 05:26:15 2025 +0000

    upstream: make writing known_hosts lines more atomic, by writing
    
    the entire line in one operation and using unbuffered stdio.
    
    Usually writes to this file are serialised on the "Are you sure you
    want to continue connecting?" prompt, but if host key checking is
    disabled and connections were being made with high concurrency
    then interleaved writes might have been possible.
    
    feedback/ok deraadt@ millert@
    
    OpenBSD-Commit-ID: d11222b49dabe5cfe0937b49cb439ba3d4847b08

commit c991273c18afc490313a9f282383eaf59d9c13b9
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Wed Apr 30 05:23:15 2025 +0000

    upstream: fix a out-of-bounds read if the known_hosts file is
    
    truncated after the hostname.
    
    Reported by the OpenAI Security Research Team
    
    ok deraadt@
    
    OpenBSD-Commit-ID: c0b516d7c80c4779a403826f73bcd8adbbc54ebd

Summary of changes:
 hostfile.c | 58 ++++++++++++++++++++++++++++++++++++++++++++++------------
 1 file changed, 46 insertions(+), 12 deletions(-)

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.