CVE-2018-7749

@@ -18,4 +18,4 @@
 
 __url__ = 'http://asyncssh.timeheart.net'
 
-__version__ = '1.12.0'
+__version__ = '1.12.1'

@@ -3,6 +3,41 @@
 Change Log
 ==========
 
+Release 1.12.1 (10 Mar 2018)
+----------------------------
+
+* Implemented a fix for CVE-2018-7749, where a modified SSH client could
+  request that an AsyncSSH server perform operations before authentication
+  had completed. Thanks go to Matthijs Kooijman for discovering and
+  reporting this issue and helping to review the fix.
+
+* Added a non-blocking collect_output() method to SSHClientProcess to
+  allow applications to retrieve data received on an output stream
+  without blocking. This call can be called multiple times and freely
+  intermixed with regular read calls with a guarantee that output will
+  always be returned in order and without duplication.
+
+* Updated debug logging implementation to make it more maintainable, and
+  to fix an issue where unprocessed packets were not logged in some cases.
+
+* Extended the support below for non-ASCII characters in comments to apply
+  to X.509 certificates, allowing an optional encoding to be passed in to
+  get_comment() and set_comment() and a get_comment_bytes() function to
+  get the raw comment bytes without performing Unicode decoding.
+
+* Fixed an issue where a UnicodeDecodeError could be reported in some
+  cases instead of a KeyEncryptionError when a private key was imported
+  using the wrong passphrase.
+
+* Fixed the reporting of the MAC algorithm selected during key exchange to
+  properly report the cipher name for GCM and Chacha ciphers that don't
+  use a separate MAC algorithm. The correct value was being returned in
+  queries after the key exchange was complete, but the logging was being
+  done before this adjustment was made.
+
+* Fixed the documentation of connection_made() in SSHSession subclasses
+  to properly reflect the type of SSHChannel objects passed to them.
+
 Release 1.12.0 (5 Feb 2018)
 ---------------------------
 

@@ -77,7 +77,7 @@ License
 
 This package is released under the following terms:
 
-  Copyright (c) 2013-2017 by Ron Frederick <ronf@timeheart.net>.
+  Copyright (c) 2013-2018 by Ron Frederick <ronf@timeheart.net>.
   All rights reserved.
 
   This program and the accompanying materials are made available under

@@ -746,6 +746,10 @@ def _recv_packet(self):
             elif (self._auth and
                   MSG_USERAUTH_FIRST <= pkttype <= MSG_USERAUTH_LAST):
                 processed = self._auth.process_packet(pkttype, seq, packet)
+            elif pkttype > MSG_USERAUTH_LAST and not self._auth_complete:
+                raise DisconnectError(DISC_PROTOCOL_ERROR,
+                                      'Invalid request received before '
+                                      'authentication was complete')
             else:
                 processed = self.process_packet(pkttype, seq, packet,
                                                 pkttype not in

@@ -130,6 +130,28 @@ def verify_and_decrypt(self, header, data, tag):
         return super().verify_and_decrypt(header, data + b'\xff', tag)
 
 
+class _PreAuthRequestClient(asyncssh.SSHClient):
+    """Test sending a request prior to auth complete"""
+
+    def __init__(self):
+        self._conn = None
+
+    def connection_made(self, conn):
+        """Save connection for use later"""
+
+        self._conn = conn
+
+    def password_auth_requested(self):
+        """Attempt to execute a command before authentication is complete"""
+
+        # pylint: disable=protected-access
+        self._conn._auth_complete = True
+
+        self._conn.send_packet(MSG_GLOBAL_REQUEST, String(b'\xff'),
+                               Boolean(True))
+        return 'pw'
+
+
 class _InternalErrorClient(asyncssh.SSHClient):
     """Test of internal error exception handler"""
 
@@ -970,8 +992,8 @@ def test_abort(self):
             yield from self.connect()
 
 
-class _TestConnectionCloseDurngAuth(ServerTestCase):
-    """Unit test for connection close during long auth callback"""
+class _TestDuringAuth(ServerTestCase):
+    """Unit test for operations during auth"""
 
     @classmethod
     @asyncio.coroutine
@@ -988,6 +1010,15 @@ def test_close_during_auth(self):
             yield from asyncio.wait_for(self.connect(username='user',
                                                      password=''), 0.5)
 
+    @asynctest
+    def test_request_during_auth(self):
+        """Test sending a request prior to auth complete"""
+
+        with self.assertRaises(asyncssh.DisconnectError):
+            yield from self.create_connection(_PreAuthRequestClient,
+                                              username='user',
+                                              compression_algs=['none'])
+
 
 @unittest.skipUnless(x509_available, 'X.509 not available')
 class _TestServerX509Self(ServerTestCase):