Builder ffmpeg64-solaris10-i386 Build #14119

Results:

Failed

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-ffmpeg64-solaris10-i386' triggered this build

Steps and Logfiles:

1. git updating ( 5 secs )
   1. stdio
2. shell  
   1. - no logs -
3. shell_1  
   1. - no logs -
4. shell_2  
   1. - no logs -
5. shell_3  
   1. - no logs -
6. shell_4  
   1. - no logs -
7. shell_5  
   1. - no logs -

Build Properties:

Forced Build Properties:

Responsible Users:

1. Joshua Rogers

   MegaManSecohnoyoudont@users.noreply.github.com

Timing:

All Changes:

:

1. Change #281597

   Category	ffmpeg
   Changed by	Joshua Rogers <MegaManSecohnoyoudont@users.noreply.github.com>
   Changed at	Sat 12 Sep 2026 22:29:19
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	2b822b7fb6ed195546bc9fd9bdb794e98222bdce

   Comments

   avformat/libssh: verify the SSH server host key
   The sftp protocol connected and authenticated without checking the server
   host key, so credentials were sent to any or spoofed server. Verify against
   known_hosts (ssh_session_is_known_server, with a pre-0.8 fallback) before
   authenticating; add a 'verify' option (default on) to opt out.
   
   Strict checking is forced on for the check: libssh otherwise reports an
   unknown server, and since 0.8 even a changed key, as known when the parsed
   ssh config says StrictHostKeyChecking no.
   
   This changes the default behaviour: like OpenSSH with
   StrictHostKeyChecking=yes, sftp:// now refuses servers that are not in the
   known_hosts file or whose key differs from the recorded one.
   
   Fixes: credentials sent to unverified SSH servers (CWE-295)
   Fixes: ZmW0mOvhU0qN
   Found-by: Joshua Rogers <joshua.rogers@aisle.com>
   Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

   Changed files

   • doc/protocols.texi
   • libavformat/libssh.c