diff options
| author | Jeff Forcier <jeff@bitprophet.org> | 2018-09-18 21:13:22 -0700 |
|---|---|---|
| committer | Jeff Forcier <jeff@bitprophet.org> | 2018-09-18 21:13:22 -0700 |
| commit | c7d13cdfa1b9f3f71b2643aff0f5c2ab45e06779 (patch) | |
| tree | 9ce51682cf08712a34ed9bddba334be3dd465080 | |
| parent | f861ef079f5078c356d40421d45c8be170ef2c7a (diff) | |
| parent | f83156a804987d5e9be7c040ec87e67820347bd7 (diff) | |
| download | paramiko-c7d13cdfa1b9f3f71b2643aff0f5c2ab45e06779.tar.gz | |
Merge branch '2.0' into 2.1
| -rw-r--r-- | sites/www/changelog.rst | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/sites/www/changelog.rst b/sites/www/changelog.rst index 5a13957d..82eae8c1 100644 --- a/sites/www/changelog.rst +++ b/sites/www/changelog.rst @@ -2,15 +2,15 @@ Changelog ========= +- :release:`2.0.9 <2018-09-18>` - :bug:`-` Modify protocol message handling such that ``Transport`` does not respond to ``MSG_UNIMPLEMENTED`` with its own ``MSG_UNIMPLEMENTED`` message. This behavior probably didn't cause any outright errors, but it doesn't seem to conform to the RFCs and could cause (non-infinite) feedback loops in some scenarios (usually those involving Paramiko on both ends). -- :bug:`1283 (1.17+)` Fix exploit (CVE pending) in Paramiko's server mode - (**not** client mode) where hostile clients could trick the server into - thinking they were authenticated without actually submitting valid - authentication. +- :bug:`1283` Fix exploit (CVE pending) in Paramiko's server mode (**not** + client mode) where hostile clients could trick the server into thinking they + were authenticated without actually submitting valid authentication. Specifically, steps have been taken to start separating client and server related message types in the message handling tables within ``Transport`` and |