0.2.15 changes

[norrisjeremy]

• Adjust maven workflow to split unit & integrations into separate steps so that they can be executed via direct mojo calls and thus avoiding potentially reexecuting prior phases.
  -- Revert ee39336 since it doesn't seem to work with Github's CI runner.
• Integrate Forbidden API Checker and resolve issues it flagged.
• Is jsch affected by the Terrapin attack? #457 address CVE-2023-48795 by adding support for new strict key exchange extension.
  -- This change introduces two new config options to control usage of the new strict key exchange extension:
  --- enable_strict_kex (set to yes by default)
  --- require_strict_kex (set to no by default)
  -- If either option (or both) is enabled, then JSch will attempt to use the new strict key exchange extension.
  --- If the require_strict_kex option is enabled and JSch detects the server does not support it, then JSch will terminate the connection and throw an exception.
  --- If the require_strict_kex option is not enabled and JSch detects the server does not support it, then JSch will fallback and proceed with the connection without using the new extension.
  --- This gives users the ability to enable a strong security posture if needed and avoid proceeding with connections to potentially insecure servers.
• Is jsch affected by the Terrapin attack? #457 add integration tests for new strict key exchange extension.
• Add support for ext-info-in-auth@openssh.com extension.
  -- This change introduces a new config option to control usage of the new ext-info-in-auth@openssh.com:
  --- enable_ext_info_in_auth (set to yes by default)

[norrisjeremy]

FYI, I can add more extensive unit tests once OpenSSH 9.6 is available in Alpine Linux so that we can use it as a TestContainer.
I have locally built OpenSSH 9.6 and executed my preliminary integration test against it and it appears to work.

[mwiede]

Very good, the https://github.com/RUB-NDS/Terrapin-Scanner)[https://github.com/RUB-NDS/Terrapin-Scanner/releases/tag/v1.0.2 reports the following for connecting from the new code:

$ ./Terrapin_Scanner_Linux_amd64 --listen 0.0.0.0:2222
Listening for incoming client connection on 0.0.0.0:2222
================================================================================
==================================== Report ====================================
================================================================================

Remote Banner: SSH-2.0-JSCH_0.2.15_SNAPSHOT

ChaCha20-Poly1305 support:   false
CBC-EtM support:             false

Strict key exchange support: true

==> The scanned peer supports Terrapin mitigations and can establish
    connections that are NOT VULNERABLE to Terrapin. Glad to see this.
    For strict key exchange to take effect, both peers must support it.

Note: This tool is provided as is, with no warranty whatsoever. It determines
      the vulnerability of a peer by checking the supported algorithms and
      support for strict key exchange. It may falsely claim a peer to be
      vulnerable if the vendor supports countermeasures other than strict key
      exchange.

For more details visit our website available at https://terrapin-attack.com

[BernhardGruen]

Much appreciated thank you for your fast fix @norrisjeremy

FYI, I can add more extensive unit tests once OpenSSH 9.6 is available in Alpine Linux so that we can use it as a TestContainer. I have locally built OpenSSH 9.6 and executed my preliminary integration test against it and it appears to work.

Alpine Linux also just released OpenSSH 9.6 for edge. The 3.19 branch got the upgrade too.

[pacion]

Can you please provide me supression for owasp xml for the vulnerability CVE-2023-48795? @norrisjeremy

[norrisjeremy]

@pacion No thank you.