9d2ee97
ssh: implement strict KEX protocol changes4e5a261
ssh: close net.Conn on all NewServerConn errors152cdb1
x509roots/fallback: update bundlefdfe1f8
ssh: defer channel window adjustmentb8ffc16
blake2b: drop Go 1.6, Go 1.8 compatibility7e6fbd8
ssh: wrap errors from client handshakebda2f3f
argon2: avoid clobbering BP325b735
ssh/test: skip TestSSHCLIAuth on Windows1eadac5
go.mod: update golang.org/x dependenciesb2d7c26
ssh: add (*Client).DialContext methodSourced from github.com/quic-go/quic-go's releases.
v0.37.7
This release contains fixes for the Honeybadger vulnerability (CVE-2023-49295):
- limit the number of queued PATH_RESPONSE frames to 256 (#4199)
- don't retransmit PATH_CHALLENGE and PATH_RESPONSE frames (#4200)
Full Changelog: https://github.com/quic-go/quic-go/compare/v0.37.6...v0.37.7
v0.37.6
This patch release contains a backport of quic-go/quic-go#4038.
Full Changelog: https://github.com/quic-go/quic-go/compare/v0.37.5...v0.37.6
v0.37.5
This patch release contains the backport of 3 fixes:
- fix handshake failure if
tls.Config.SessionTicketDisabled = false, buttls.Config.GetConfigForClientreturns a config that disables session tickets: #4030- use the correct hash function for TLS_AES_256_GCM_SHA384: #4031
- automatically set the
tls.Config.ServerName: #4032Full Changelog: https://github.com/quic-go/quic-go/compare/v0.37.4...v0.37.5
21609dd
don't retransmit PATH_CHALLENGE and PATH_RESPONSE frames (#4200)d7aa627
limit the number of queued PATH_RESPONSE frames to 256 (#4199)e2c360c
reassemble post-handshake TLS messages before passing them to crypto/tls
(#4038)e9f7f46
automatically set the tls.Config.ServerName if unset (#4032)12d84c4
handshake: use the correct hash function for TLS_AES_256_GCM_SHA384 (#4031)b1635df
ignore QUICConn.SendSessionTicket error if session tickets are disabled
(#4030)
+