#libssh — Public Fediverse posts

"Internet Bug Bounty is taking a break and is not accepting new submissions."

Killed by AI Slop.

No bug bounty for #libssh anymore.

The #libssh team released version 0.12.0 and 0.11.4 including security fixes. Make sure to update. libssh is a C library implementing the SSH protocol.

Highlights:
* Support for FIDO/U2F keys
* Support for hybrid key exchange mechanisms using Quantum Resistant cryptography for all backends
* Support for Ed25519 keys through PKCS#11
* Use curve25519 implementation from mbedTLS and libgcrypt
* Support for GSSAPI Key Exchange

https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/

#ssh #security #linux #admin

I ran a quick SFTP performance test with #curl built to use #libssh 0.11.1 vs one built that uses #libssh2 1.11.1 over a 400ms latency connection.

One of them managed to perform this at 1049K/sec, the other reached only 249K/sec.

And the winner is...

libssh2

Funny detail: I sped it up for this kind of use case **fifteen years ago** and blogged about it: https://daniel.haxx.se/blog/2010/12/08/making-sftp-transfers-fast/

Guile-SSH 0.18.0 released:
https://github.com/artyom-poptsov/guile-ssh/releases/tag/v0.18.0

#guile #scheme #guile_ssh #libssh

It seems that I fixed Guile-SSH build with libssh 0.11. The changes are on the "master" branch and will be in included in the next release.

GitHub CI job shows that everything builds fine as well. I'm using GNU Guix to test Guile-SSH against libssh 0.11, so likely if it builds on my machine this way then it builds on others. Nevertheless if you'll experience any Guile-SSH errors please report them to me.

#guile #guile_ssh #libssh #projects

@campuscodi: A few notes and thoughts on CVE-2023-2283 in #libssh:

* libssh (libssh-4 in Debian and derivatives) ≠ libssh2 (libssh2-1 in Debian and derivatives)

* Obviously only servers using libssh to let users log in should be affected by any authentication bypass. Most libssh reverse dependencies though seem to be client-side applications.

The only potential libssh server-side reverse dependencies I found so far are:

* #cryptsetup-ssh
* #tmate-ssh-server
* maybe #cockpit-bridge

The libssh team is proud to announce the release of libssh version 0.11.0. This latest version brings exciting new features such as better async SFTP IO, PKCS#11 provider support for OpenSSL 3.0, testing for GSSAPI authentication, and proxy jump, along with many other enhancements and features. More at: https://www.libssh.org/2024/08/08/libssh-0-11-0-release/ #libssh #ssh

#libssh had a successful summer of code. We will get two new nice features in libssh, more details:
https://www.libssh.org/2023/09/07/wrapping-up-2023-gsoc/

I've just bumped the copyright year in the https://libssh.org header file. #libssh is getting 20 years old this year!

I'm proud to announce the release of #libssh 0.9.0 with a lot of new features (AES-GCM, ETM, FIPS, ...), improvements and bug fixes. We also improved our test infrastructure to avoid introducing regressions. Learn more about it at: https://www.libssh.org/2019/06/28/libssh-0-9-0/

#libssh #win

'17 Oct 2018 08:39:13' #libssh fix (against CVE-2018-10933) landed in #FreeBSD https://www.freshports.org/security/libssh/