Browse Source
2.10.1: - [Bug]: (CVE-2022-24302) Creation of new private key files using PKey subclasses was subject to a race condition between file creation & mode modification, which could be exploited by an attacker with knowledge of where the Paramiko-using code would write out such files. - This has been patched by using os.open and os.fdopen to ensure new files are opened with the correct mode immediately. We’ve left the subsequent explicit chmod in place to minimize any possible disruption, though it may get removed in future backwards- incompatible updates. - Thanks to Jan Schejbal for the report & feedback on the solution, and to Jeremy Katz at Tidelift for coordinating the disclosure. 2.10.0: - [Feature] Add support for OpenSSH’s Windows agent as a fallback when Putty/WinPageant isn’t available or functional. Reported by @benj56 with patches/PRs from @lewgordon and Patrick Spendrin. - [Feature] Add support for the %C token when parsing SSH config files. Foundational PR submitted by @jbrand42. - [Bug] Significantly speed up low-level read/write actions on SFTPFile objects by using bytearray/memoryview. This is unlikely to change anything for users of the higher level methods like SFTPClient.get or SFTPClient.getfo, but users of SFTPClient.open will likely see orders of magnitude improvements for files larger than a few megabytes in size. - Thanks to @jkji for the original report and to Sevastian Tchernov for the patch. - [Support] Add six explicitly to install-requires; it snuck into active use at some point but has only been indicated by transitive dependency on bcrypt until they somewhat-recently dropped it. This will be short-lived until we drop Python 2 support. Thanks to Sondre Lillebø Gundersen for catch & patch. Signed-off-by: Javier Marcet <javier@marcet.info>lilik-openwrt-22.03
Javier Marcet
3 years ago
committed by
Rosen Penev
Rosen Penev
1 changed files with 2 additions and 2 deletions
+ 2
- 2
lang/python/python-paramiko/Makefile
View File
Loading…