Skip to content

Commit 3000486

Browse files
manfred-kaisermanfred-kaiser
authored
Merge branch 'develop' into patch-6
2 parents 80859fa + 6cb42cb commit 3000486

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

66 files changed

+2665
-1061
lines changed

‎.bumpversion.cfg

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
[bumpversion]
2-
current_version = 0.6.0
2+
current_version = 0.6.3
33

44
[bumpversion:file:snapcraft.yaml]
55

‎AppImageBuilder.yml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ AppDir:
1717
id: at.ssh-mitm.server
1818
name: ssh-mitm
1919
icon: ssh-mitm
20-
version: 0.6.0
20+
version: 0.6.3
2121
# Set the python executable as entry point
2222
exec: usr/bin/python3
2323
# Set the application main script path as argument. Use '$@' to forward CLI parameters
@@ -70,4 +70,3 @@ AppImage:
7070
arch: x86_64
7171
file_name: ssh-mitm-x86_64.AppImage
7272
update-information: gh-releases-zsync|ssh-mitm|ssh-mitm|latest|ssh-mitm-x86_64.AppImage.zsync
73-
sign-key: None

‎CHANGELOG.md

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
## [0.6.3] - 2021-11-04
11+
12+
- fixed hostname regex (error in regex)
13+
14+
## [0.6.2] - 2021-11-04
15+
16+
### Fixed
17+
18+
- fixed hostname regex (regex was to strict and not all hostnames were allowed)
19+
20+
## [0.6.1] - 2021-09-21
21+
22+
### Fixed
23+
24+
- missing environment variable in snap file
25+
- fixed ssh-mitm-audit command
26+
1027
## [0.6.0] - 2021-09-13
1128

1229
### Added
@@ -203,7 +220,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
203220

204221
- fixed pseudo terminal on exec command
205222

206-
[Unreleased]: https://github.com/ssh-mitm/ssh-mitm/compare/0.6.0...develop
223+
[Unreleased]: https://github.com/ssh-mitm/ssh-mitm/compare/0.6.3...develop
224+
[0.6.3]: https://github.com/ssh-mitm/ssh-mitm/compare/0.6.2...0.6.3
225+
[0.6.2]: https://github.com/ssh-mitm/ssh-mitm/compare/0.6.1...0.6.2
226+
[0.6.1]: https://github.com/ssh-mitm/ssh-mitm/compare/0.6.0...0.6.1
207227
[0.6.0]: https://github.com/ssh-mitm/ssh-mitm/compare/0.5.13...0.6.0
208228
[0.5.13]: https://github.com/ssh-mitm/ssh-mitm/compare/0.5.12...0.5.13
209229
[0.5.12]: https://github.com/ssh-mitm/ssh-mitm/compare/0.5.11...0.5.12

‎README.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,21 +54,23 @@ When publickey authentication is possible, a forwarded agent is needed to login
5454

5555
<img src="https://www.ssh-mitm.at/assets/images/streamline-free/monitor-loading-progress.svg" align="left" width="128">
5656

57-
**SSH-MITM** can be installed as a [Ubuntu Snap](https://snapcraft.io/ssh-mitm), [PIP-Package](https://pypi.org/project/ssh-mitm/) or [AppImage](https://github.com/ssh-mitm/ssh-mitm/releases/latest)
57+
**SSH-MITM** can be installed as a [Ubuntu Snap](https://snapcraft.io/ssh-mitm), [PIP-Package](https://pypi.org/project/ssh-mitm/) or [AppImage](https://github.com/ssh-mitm/ssh-mitm/releases/latest) and even runs on **[Android devices](https://github.com/ssh-mitm/ssh-mitm/discussions/83#discussioncomment-1531873)**
5858

5959
# install ssh-mitm as snap package
6060
$ sudo snap install ssh-mitm
6161

6262
# install ssh-mitm as python pip package
6363
$ pip install ssh-mitm
6464

65+
66+
6567
## Quickstart
6668

6769
<img src="https://www.ssh-mitm.at/assets/images/streamline-free/programmer-male.svg" align="left" width="128">
6870

6971
To start SSH-MITM, all you have to do is run this command in your terminal of choice.
7072

71-
$ ssh-mitm --remote-host 192.168.0.x
73+
$ ssh-mitm --remote-host 192.168.0.x:PORT
7274

7375
Now let's try to connect. SSH-MITM is listening on port 10022.
7476

‎doc/CVE-2016-20012.rst

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
CVE-2016-20012
2+
==============
3+
4+
.. raw:: html
5+
6+
<div class="card card-margin">
7+
<div class="card-header no-border">
8+
<h5 class="card-title cve-title">CVE-2016-20012</h5>
9+
</div>
10+
<div class="card-body pt-0">
11+
<div class="widget-49">
12+
<div class="widget-49-title-wrapper">
13+
<div class="widget-49-date-primary">
14+
<span class="widget-49-date-day">7.4</span>
15+
<span class="widget-49-date-month">CVSS</span>
16+
</div>
17+
<div class="widget-49-meeting-info">
18+
<span class="widget-49-pro-title"><b>Vector:</b> CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
19+
<span class="widget-49-meeting-time">
20+
<a href="https://nvd.nist.gov/vuln/detail/CVE-2016-20012">https://nvd.nist.gov/vuln/detail/CVE-2016-20012</a>
21+
</span>
22+
</div>
23+
</div>
24+
<p class="widget-49-meeting-integration">
25+
<i class="fas fa-check"></i> integrated in <a href="https://github.com/ssh-mitm/ssh-mitm/blob/master/ssh_proxy_server/authentication.py">SSH-MITM server</a>
26+
</p>
27+
<p class="widget-49-meeting-text">
28+
OpenSSH through 8.7 allows remote attackers, who have a suspicion that
29+
a certain combination of username and public key is known to an SSH server,
30+
to test whether this suspicion is correct. This occurs because a challenge is
31+
sent only when that combination could be valid for a login session.
32+
</p>
33+
<span class="widget-49-pro-title"><b>Affected Software:</b></span>
34+
<ul class="widget-49-meeting-points">
35+
<li class="widget-49-meeting-item"><b>OpenSSH</b> &lt;=8.7</li>
36+
</ul>
37+
</div>
38+
</div>
39+
</div>
40+
41+
42+
References
43+
----------
44+
45+
* https://github.com/openssh/openssh-portable/blob/d0fffc88c8fe90c1815c6f4097bc8cbcabc0f3dd/auth2-pubkey.c#L261-L265
46+
* https://github.com/openssh/openssh-portable/pull/270
47+
* https://rushter.com/blog/public-ssh-keys/
48+
* https://utcc.utoronto.ca/~cks/space/blog/tech/SSHKeysAreInfoLeak

‎doc/CVE-2021-36367.rst

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
CVE-2021-36367
2+
==============
3+
4+
.. raw:: html
5+
6+
<div class="card card-margin">
7+
<div class="card-header no-border">
8+
<h5 class="card-title cve-title">CVE-2021-36367</h5>
9+
</div>
10+
<div class="card-body pt-0">
11+
<div class="widget-49">
12+
<div class="widget-49-title-wrapper">
13+
<div class="widget-49-date-primary">
14+
<span class="widget-49-date-day">8.1</span>
15+
<span class="widget-49-date-month">CVSS</span>
16+
</div>
17+
<div class="widget-49-meeting-info">
18+
<span class="widget-49-pro-title"><b>Vector:</b> CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N</span>
19+
<span class="widget-49-meeting-time">
20+
<a href="https://nvd.nist.gov/vuln/detail/CVE-2021-36367">https://nvd.nist.gov/vuln/detail/CVE-2021-36367</a>
21+
</span>
22+
</div>
23+
</div>
24+
<p class="widget-49-meeting-integration">
25+
<i class="fas fa-check"></i> integrated in SSH-MITM server
26+
</p>
27+
<p class="widget-49-meeting-text">
28+
<b>Note: MITRE's description is wrong. Please read note bellow.</b></br>
29+
PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response.
30+
This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt
31+
(that the attacker can use to capture credential data, and use that data for purposes that are undesired by the client user).
32+
</p>
33+
<span class="widget-49-pro-title"><b>Affected Software:</b></span>
34+
<ul class="widget-49-meeting-points">
35+
<li class="widget-49-meeting-item"><b>PuTTY</b> &lt; 0.71</li>
36+
</ul>
37+
</div>
38+
</div>
39+
</div>
40+
41+
.. note::
42+
43+
**Comment from Simon Tatham:**
44+
45+
CVE-2021-36367 refers to this new option as a fix for a vulnerability, and describes the vulnerability
46+
as "PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive
47+
authentication response". With respect to the author of that text, we consider that to be misleading.
48+
It is perfectly legal for the server to waive authentication, and actually useful in some legitimate use cases;
49+
it is perfectly legal for PuTTY to proceed with the connection regardless; and the trust sigil system introduced
50+
in 0.71 already defends against every spoofing attack we know of that a server could attempt by doing this unexpectedly.
51+
This new option is a UI improvement, but not in and of itself a vital vulnerability fix.
52+
53+
54+
References
55+
----------
56+
57+
* https://git.tartarus.org/?p=simon/putty.git;a=commit;h=1dc5659aa62848f0aeb5de7bd3839fecc7debefa
58+
* https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html

‎doc/CVE-2021-36368.rst

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
CVE-2021-36368
2+
==============
3+
4+
.. raw:: html
5+
6+
<div class="card card-margin">
7+
<div class="card-header no-border">
8+
<h5 class="card-title cve-title">CVE-2021-36368</h5>
9+
</div>
10+
<div class="card-body pt-0">
11+
<div class="widget-49">
12+
<div class="widget-49-title-wrapper">
13+
<div class="widget-49-date-primary">
14+
<span class="widget-49-date-day">N/A</span>
15+
<span class="widget-49-date-month">CVSS</span>
16+
</div>
17+
<div class="widget-49-meeting-info">
18+
<span class="widget-49-pro-title"><b>Vector:</b> N/A</span>
19+
<span class="widget-49-meeting-time">
20+
<a href="https://nvd.nist.gov/vuln/detail/CVE-2021-36368">https://nvd.nist.gov/vuln/detail/CVE-2021-36368</a>
21+
</span>
22+
</div>
23+
</div>
24+
<p class="widget-49-meeting-integration">
25+
<i class="fas fa-check"></i> integrated in SSH-MITM server
26+
</p>
27+
<p class="widget-49-meeting-text">
28+
This CVE is marked as reserved.
29+
</p>
30+
<span class="widget-49-pro-title"><b>Affected Software:</b></span>
31+
<ul class="widget-49-meeting-points">
32+
<li class="widget-49-meeting-item"><b>OpenSSHH</b> &lt;= 8.7</li>
33+
</ul>
34+
</div>
35+
</div>
36+
</div>

‎doc/CVE-2021-36369.rst

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
CVE-2021-36369
2+
==============
3+
4+
.. raw:: html
5+
6+
<div class="card card-margin">
7+
<div class="card-header no-border">
8+
<h5 class="card-title cve-title">CVE-2021-36369</h5>
9+
</div>
10+
<div class="card-body pt-0">
11+
<div class="widget-49">
12+
<div class="widget-49-title-wrapper">
13+
<div class="widget-49-date-primary">
14+
<span class="widget-49-date-day">N/A</span>
15+
<span class="widget-49-date-month">CVSS</span>
16+
</div>
17+
<div class="widget-49-meeting-info">
18+
<span class="widget-49-pro-title"><b>Vector:</b> N/A</span>
19+
<span class="widget-49-meeting-time">
20+
<a href="https://nvd.nist.gov/vuln/detail/CVE-2021-36369">https://nvd.nist.gov/vuln/detail/CVE-2021-36369</a>
21+
</span>
22+
</div>
23+
</div>
24+
<p class="widget-49-meeting-integration">
25+
<i class="fas fa-check"></i> integrated in SSH-MITM server
26+
</p>
27+
<p class="widget-49-meeting-text">
28+
This CVE is marked as reserved.
29+
</p>
30+
<span class="widget-49-pro-title"><b>Affected Software:</b></span>
31+
<ul class="widget-49-meeting-points">
32+
<li class="widget-49-meeting-item"><b>Dropbear</b> &lt;= 2020.81</li>
33+
</ul>
34+
</div>
35+
</div>
36+
</div>

0 commit comments

Comments
 (0)