< back to search

gpp_maybe Security update for sslh
openSUSE-2025-231

This update for sslh fixes the following issues: sslh was updated to 2.2.4: * Fix CVE-2025-46806 (boo#1243120) for "Misaligned Memory Accesses in `is_openvpn_protocol()`" * Fix CVE-2025-46807 (boo#1243122) for "File Descriptor Exhaustion in sslh-select and sslh-ev" * Fix potential parsing of undefined data in syslog probe (no CVE assigned) Update to 2.2.3: * Reverse older commit: version.h cannot be included without breaking the build (everything recompiles every time) and the release archive creation (which relies on git tags). Update to 2.2.2: * Fix potential vulnerability similar to CVE-2020-28935 Update to 2.2.1: * Fix compilation when libproxyprotocol is not present Update to 2.2.0: * Add a boolean setting "is_unix" for listen and protocol entries. This will use the 'host' setting as a path name to a socket file, and connections (listening or connecting) will be performed on Unix socket instead of Internet sockets. * Support HAProxy's proxyprotocol on the backend server side. * Lots of documentation about a new, simpler way to perform transparent proxying. * New "verbose" option that overrides all other verbose settings. Update to 2.1.3: * Landlock access fix Update to 2.1.2: * Fix inetd Update to 2.1.1: * Fix MacOS build error Update to 2.1.0: * Support for the Landlock LSM. After initial setup, sslh gives up all local file access rights. * Reintroduced --ssl as an alias to --tls. * Introduce autoconf to adapt to landlock presence. * Close connexion without error message if remote client forcefully closes connexion, for Windows. Update to 2.0.1: * New semver-compatible version number * New sslh-ev: this is functionaly equivalent to sslh-select (mono-process, only forks for specified protocols), but based on libev, which should make it scalable to large numbers of connections. * New log system: instead of –verbose with arbitrary levels, there are now several message classes. Each message class can be set to go to stderr, syslog, or both. Classes are documented in example.cfg. * UDP connections are now managed in a hash to avoid linear searches. The downside is that the number of UDP connections is a hard limit, configurable with the ‘udp_max_connections’, which defaults to 1024. Timeouts are managed with lists. * inetd merges stderr output to what is sent to the client, which is a security issue as it might give information to an attacker. When inetd is activated, stderr is forcibly closed. * New protocol-level option resolve_on_forward, requests that target names are resolved at each connection instead of at startup. Useful for dynamic DNS situations.

cloud_download Downloads

SUSE Package Hub 15.7 x86_64
  • Packages
    sslh
    SSL/SSH multiplexer
    2.2.4-bp157.2.3.1 lock rpm
SUSE Package Hub 15.7 s390x
  • Packages
    sslh
    SSL/SSH multiplexer
    2.2.4-bp157.2.3.1 lock rpm
SUSE Package Hub 15.7 ppc64le
  • Packages
    sslh
    SSL/SSH multiplexer
    2.2.4-bp157.2.3.1 lock rpm
SUSE Package Hub 15.7 aarch64
  • Packages
    sslh
    SSL/SSH multiplexer
    2.2.4-bp157.2.3.1 lock rpm
SUSE Package Hub 15.6 ppc64le
  • Packages
    sslh
    SSL/SSH multiplexer
    2.2.4-bp156.5.3.1 lock rpm
SUSE Package Hub 15.6 aarch64
  • Packages
    sslh
    SSL/SSH multiplexer
    2.2.4-bp156.5.3.1 lock rpm
SUSE Package Hub 15.6 x86_64
  • Packages
    sslh
    SSL/SSH multiplexer
    2.2.4-bp156.5.3.1 lock rpm
SUSE Package Hub 15.6 s390x
  • Packages
    sslh
    SSL/SSH multiplexer
    2.2.4-bp156.5.3.1 lock rpm