|
| 1 | +# wolfSSH v1.5.0 (April 17, 2026) |
| 2 | + |
| 3 | +## Vulnerabilities |
| 4 | +- [Low] CVE-2026-0930. Potential read out of bounds case with wolfSSHd on |
| 5 | + Windows while handling a terminal resize request. An authenticated user could |
| 6 | + trigger the out of bounds read after establishing a connection which would |
| 7 | + leak the adjacent stack memory to the pseudo-console output. Thanks to Luigino |
| 8 | + Camastra and Pavel Kohout for the report. Fixed in PR 864 |
| 9 | + |
| 10 | +## New Features |
| 11 | + |
| 12 | +- Added ML-KEM hybrid KEX algorithms `mlkem1024nistp384-sha384` and |
| 13 | + `mlkem768x25519-sha256` from draft-ietf-sshm-mlkem-hybrid-kex, with KEX tests |
| 14 | + driven by name and a GitHub action testing interop against OpenSSH. (PR 869) |
| 15 | +- Allowed building wolfSSH against a wolfSSL FIPS build that has HashDRBG |
| 16 | + disabled. (PR 833) |
| 17 | +- Added `lcd` and `lls` commands to the SFTP example client for changing and |
| 18 | + listing the local working directory within a session. (PR 909) |
| 19 | +- Added a public accessor function for retrieving a channel's type. (PR 873) |
| 20 | +- Added client-side support for `rsa-sha2-512` signatures, separating the |
| 21 | + key type from the signature type so `ssh-rsa` keys can be used with |
| 22 | + `ssh-rsa`, `rsa-sha2-256`, or `rsa-sha2-512` signatures. (PR 890) |
| 23 | +- Added new CI workflows: codespell, multi-compiler builds (gcc 11/12/13 and |
| 24 | + clang 14/15/17), and sanitizer builds (ASan, UBSan, LeakSan). (PR 884) |
| 25 | +- Added a GitHub action to run automated Coverity scans. (PR 872) |
| 26 | +- Added SFTP contention testing that simulates network latency with `netem` |
| 27 | + to exercise the non-blocking SFTP server paths. (PR 877) |
| 28 | +- Added integration tests for client public-key authentication covering |
| 29 | + valid RSA, valid ECC, and wrong-key rejection. (PR 913) |
| 30 | +- Added a unit test for `VerifyMac` using a new internal-only test entry |
| 31 | + point that injects packets with corrupted MACs. (PR 912) |
| 32 | +- Added a Windows wolfsshd to wolfsftp large-transfer test and an additional |
| 33 | + large SFTP transfer test with an enlarged SFTP read/write buffer. (PR 874) |
| 34 | +- Added a forwarding regression test for the echoserver. (PR 874) |
| 35 | + |
| 36 | +## Improvements |
| 37 | + |
| 38 | +- Replaced `WMEMCMP` in `CheckAuthKeysLine` with a constant-time comparison |
| 39 | + to avoid leaking authorized-key material through timing. (PR 915) |
| 40 | +- Switched SFTP `RecvOpen` to use the same `GetAndCleanPath()` helper that |
| 41 | + the other SFTP handlers use. (PR 867) |
| 42 | +- Hardened `wolfSSH_CleanPath` used by SCP. (PR 865) |
| 43 | +- Reworked `wolfSSH_SFTP_RecvOpen` to allocate the response buffer outside |
| 44 | + the success path and added a centralized cleanup phase so failure cases |
| 45 | + send a proper SFTP status packet. (PR 905) |
| 46 | +- Reworked the SFTP example tests to use a table linking each command to |
| 47 | + its expected output, cleaned up working directories before each run, and |
| 48 | + fixed an argument-parsing underflow when commands receive empty args. |
| 49 | + (PR 911) |
| 50 | +- Hardened `SendUserAuthKeyboardResponse` against null `ssh` and missing |
| 51 | + `userAuthCb`, validated `PreparePacket()` success, and added a regression |
| 52 | + test. (PR 910) |
| 53 | +- Made SFTP send/read handling more robust around multi-byte passwords and |
| 54 | + cleaned up file mode and attribute reporting. (PR 882) |
| 55 | +- Added rekey support to additional SFTP client commands, switched |
| 56 | + `wolfsftp.c` to use `NoticeError` consistently, and fixed forwarding and |
| 57 | + agent handling in the echoserver. (PR 874) |
| 58 | +- Validated channel-accept request and reply payloads. (PR 902) |
| 59 | +- Hardened `DoKexDhReply()` to reject the server's public key when no |
| 60 | + `PublicKeyCheck` callback is registered, with a regression test added. |
| 61 | + (PR 917) |
| 62 | +- Hardened `DoGlobalRequestFwd()` to reject `tcpip-forward` global requests |
| 63 | + when no `fwdCb` is registered, and deferred `SSH_MSG_REQUEST_SUCCESS` until |
| 64 | + the policy callback approves. (PR 918) |
| 65 | +- Hardened `DoChannelOpen()` to reject channel-open requests when the |
| 66 | + required callback is not registered, with a regression test added. |
| 67 | + (PR 919) |
| 68 | +- Added validation of the server's DH group parameters in |
| 69 | + `DoKexDhGexGroup` so the prime `p` is verified to be safe (`p` prime and |
| 70 | + `(p-1)/2` prime), plus unit tests covering known safe and unsafe primes. |
| 71 | + (PR 922) |
| 72 | +- Added preprocessor guards so the Curve25519 union member used by the |
| 73 | + hybrid Curve25519+ML-KEM paths is only required when one of those KEX |
| 74 | + modes is enabled. (PR 901) |
| 75 | +- Reorganized SFTP function placement, prototypes, and build guards, and |
| 76 | + fixed mismatched guards around `SFTP_FreeHandles` in |
| 77 | + `wolfSSH_SFTP_free`. (PR 891) |
| 78 | +- Cleaned up macOS threading by switching to named POSIX semaphores and |
| 79 | + consolidating semaphore use behind a single wrapper API. (PR 895, |
| 80 | + resolves issue #893) |
| 81 | +- Improved `wolfSSH_ProcessBuffer` to validate the input type, handled |
| 82 | + non-`WOLFSSH_CERTS` builds in `SendKexDhReply`, allowed |
| 83 | + `DoUserAuthRequestRsa()` and `DoUserAuthRequestRsaCert()` to accept |
| 84 | + `ssh-rsa`, `rsa-sha2-256`, and `rsa-sha2-512`, and added the |
| 85 | + `test_wolfSSH_CTX_UsePrivateKey_buffer_pem` API test. (PR 906) |
| 86 | +- Updated the FatFS test to cache the source archive and follow the same |
| 87 | + wolfSSL build pattern as the other workflows. (PR 878) |
| 88 | +- Avoided setting the terminal size to 0x0 when running the echoserver in |
| 89 | + echo mode, which left vim and other tools mis-sized after tests. (PR 868) |
| 90 | +- Fixed an `snprintf` format-truncation warning in the wolfsshd test |
| 91 | + harness and used `sizeof` to size command buffers. (PR 866) |
| 92 | +- Misc cleanup: whitespace in the global request functions and split the |
| 93 | + echoserver portion of the testsuite into its own function. (PR 873) |
| 94 | + |
| 95 | +## Fixes |
| 96 | + |
| 97 | +- Fixed an SFTP server hang on `WS_WANT_WRITE` with non-blocking sockets: |
| 98 | + `wolfSSH_SFTP_buffer_send()` now flushes any pending output buffered from |
| 99 | + a previous `WS_WANT_WRITE` before queuing more data. (PR 876) |
| 100 | +- Fixed a Coverity untrusted-divisor finding by reworking `ato32()` to mask |
| 101 | + and shift defensively. (PR 870, CID 572837) |
| 102 | +- Simplified and fixed `AddAssign64` when `WOLFSSL_MAX_32BIT` is not |
| 103 | + defined. (PR 894) |
| 104 | +- Added bounds checks in the FatFS-backed `ff_close`, `ff_pwrite`, and |
| 105 | + `ff_pread` SFTP helpers. (PR 904) |
| 106 | +- Fixed `wolfSSH_AGENT_Relay()` to evaluate the size return rather than the |
| 107 | + status code. (PR 903) |
| 108 | +- Fixed `wolfSSH_DoModes()` to update the requested output flags rather |
| 109 | + than overwriting the local mode flags. (PR 897) |
| 110 | +- Added missing `wc_HashFree()` calls in the RSA/ECC `BuildUserAuthRequest` |
| 111 | + paths and added Ed25519 key cleanup in `FreePubKey()` with a |
| 112 | + `keyAllocated` flag tracked in `ParseEd25519PubKey()`. (PR 896) |
| 113 | +- Fixed Windows authentication: `SetupUserTokenWin()` now uses |
| 114 | + `DomainName.Length` for `DomainName.MaximumLength`, and |
| 115 | + `CheckPasswordWIN()` now computes `usrWSz` as a wide-character length. |
| 116 | + (PR 898) |
| 117 | +- Fixed several smaller findings: foreground-color mask in mode 30, an |
| 118 | + error-path guard around `findHandle`, bounds-checked `GetSkip()` use in |
| 119 | + `ParseRSAPubKey()` / `ParseECCPubKey()`, and a length-validation bug. |
| 120 | + (PR 899) |
| 121 | +- Fixed compilation when `WOLFSSH_NO_NISTP256_MLKEM768_SHA256` is defined. |
| 122 | + (PR 887) |
| 123 | +- Fixed a non-constant-time password-hash comparison and added missing |
| 124 | + bounds checks in `DoIgnore`, `DoUserAuthRequestPassword`, |
| 125 | + `DoServiceRequest`, and `PrepareUserAuthRequestEcc`, plus an unsigned-vs- |
| 126 | + zero comparison. (PR 892) |
| 127 | +- Static-analysis fixes: uninitialized `mode` in FatFS `ff_open`, an |
| 128 | + operator-precedence bug, missing `wc_ecc_init()` before ECC key import, |
| 129 | + unchecked `wc_InitRsaKey` return, missing `break` between switch cases, |
| 130 | + and missing `ForceZero` on a plaintext password copy. (PR 883) |
| 131 | +- Static-analysis fixes: missing null check on a duplicated string, bounds |
| 132 | + check on an addition using a peer value, null dereference after a failed |
| 133 | + channel lookup, wrong pointer checked for null, and a wrong bitwise |
| 134 | + operator when testing an attribute. (PR 881) |
| 135 | +- Static-analysis fixes: logical operator in public-key type validation, |
| 136 | + buffer over-read in `wolfSSH_DoModes` terminal-mode parsing, two bugs in |
| 137 | + `PostRemoveId` agent identity removal, digest comparison in `FindKeyId`, |
| 138 | + octal validation loop index in `GetScpFileMode`, wrong variable checked |
| 139 | + in the `DoCheckUser` auth callback, and a NULL pointer dereference in |
| 140 | + `wolfSSH_SetTpmDev` / `wolfSSH_SetTpmKey`. (PR 880) |
| 141 | +- Static-analysis fixes: an `oct2dec` typo, a linked-list leak, Nucleus |
| 142 | + month and hour handling, `DoDisconnect` now signals connection |
| 143 | + termination, `DoChannelOpen` returns a proper failure response (with a |
| 144 | + regression test), and the host-key signature algorithm name is now |
| 145 | + validated in `DoKexDhReply()`. (PR 908) |
| 146 | +- Fixed `PostSignRequest` to pass the correct `digestSz` to |
| 147 | + `SignHashRsa()`. (PR 916) |
| 148 | +- Fixed `DoChannelOpenConf()` to update `idx` with the consumed length for |
| 149 | + consistency and correctness. (PR 920) |
| 150 | +- Fixed the server-side `DoKexDhReply()` to set `expectMsgId` to |
| 151 | + `MSGID_NEWKEYS` before sending its new keys message. (PR 921) |
| 152 | + |
| 153 | +--- |
| 154 | + |
1 | 155 | # wolfSSH v1.4.22 (January 5, 2026) |
2 | 156 |
|
3 | 157 | ## Vulnerabilities |
|
0 commit comments