This is an automated email from the ASF dual-hosted git repository.
tomaswolf pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mina-sshd.git
The following commit(s) were added to refs/heads/master by this push:
new ca7fa4f0d Update documentation
ca7fa4f0d is described below
commit ca7fa4f0d798255387edb4af42bba00dcdf81be3
Author: Thomas Wolf <[email protected]>
AuthorDate: Sat Oct 3 13:53:01 2026 +0200
Update documentation
---
docs/changes/2.20.0.md | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/docs/changes/2.20.0.md b/docs/changes/2.20.0.md
index 46de7bef3..ee93109bf 100644
--- a/docs/changes/2.20.0.md
+++ b/docs/changes/2.20.0.md
@@ -5,14 +5,19 @@
* [GH-656](https://github.com/apache/mina-sshd/issues/656)
`ChannelPipedInputStream`: shrink buffer when emptied
* [GH-906](https://github.com/apache/mina-sshd/issues/906) Fix finding a
signature factory for BC ed25519 keys
* [GH-911](https://github.com/apache/mina-sshd/issues/911) Fix server-side
SOCKS5 proxy for fragmented and pipelined CONNECT requests
-* Allow asynchronous authentication only for password and keyboard-interactive
authentication schemes
-* Fix authentication requiring multiple public keys (server-side)
-* Better argument handling in sshd-git
* More checks in authentication (server-side)
-* Better SCP command handling
-* SFTP client: simplify response message handling
-* Fix check-file-name/check-file-handle SFTP v6 extension (server-side)
-* Improve LDAP authentication (sshd-ldap)
+
+**Security fixes**
+
+* Allow asynchronous authentication only for password and keyboard-interactive
authentication schemes. Resolves
[CVE-2026-77185](https://www.cve.org/CVERecord?id=CVE-2026-77185),
[announced](https://lists.apache.org/thread.html/t8pn812yq8ndokxyfxztg8tovov1284n)
2026-09-29.
+* Fix authentication requiring multiple public keys (server-side). Resolves
[CVE-2026-93994](https://www.cve.org/CVERecord?id=CVE-2026-93994),
[announced](https://lists.apache.org/thread.html/9t3vsm8rnvwdv9779mlg1lq2fbwojdwp)
2026-09-29.
+* Better argument handling in sshd-git. Resolves
[CVE-2026-93995](https://www.cve.org/CVERecord?id=CVE-2026-93995),
[announced](https://lists.apache.org/thread.html/k13ox2xlry38h9gh6rhmh1d9zs345clk)
2026-09-29.
+* Better SCP command handling. Resolves
[CVE-2026-93996](https://www.cve.org/CVERecord?id=CVE-2026-93996),
[announced](https://lists.apache.org/thread.html/xwk8vogkpphcpm01hrt9tb6mgnpjzp35)
2026-09-29.
+* SFTP client: simplify response message handling. Resolves
[CVE-2026-94002](https://www.cve.org/CVERecord?id=CVE-2026-94002),
[announced](https://lists.apache.org/thread.html/x2cb00kh4qvsq145tj2w4g3toy8cybld)
2026-09-29.
+* Fix check-file-name/check-file-handle SFTP v6 extension (server-side).
Resolves [CVE-2026-94029](https://www.cve.org/CVERecord?id=CVE-2026-94029),
[announced](https://lists.apache.org/thread.html/ytbl4rwby62xl7llm3wp7k975wwdx99t)
2026-09-29.
+* Improve LDAP authentication (sshd-ldap).
+ * Resolves
[CVE-2026-94052](https://www.cve.org/CVERecord?id=CVE-2026-94052),
[announced](https://lists.apache.org/thread.html/qch5kdwwms13y6bylb7c6qqzq718wn24)
2026-09-29.
+ * Resolves
[CVE-2026-94053](https://www.cve.org/CVERecord?id=CVE-2026-94053),
[announced](https://lists.apache.org/thread.html/cyrxkdzl3c70rrqs3klqphqz1hwm7p41)
2026-09-29.
## New Features
