v2.1.1

v2.1.1 - Security Patch: SSH Vulnerability Fixes

Security Updates

This release addresses two HIGH severity vulnerabilities in the SSH tunneling layer that could allow malicious peers to cause denial of service
through connection deadlocks.

Fixed Vulnerabilities

CVE-2026-56855 (GO-2026-6355) - CVSS 7.5

• Impact: Malicious peer could send crafted messages after SSH channel establishment to deadlock the entire connection
• Root Cause: Improper handling of RFC 4254 channel messages
• Resolution: All channel messages are now handled explicitly; malformed messages trigger connection teardown instead of blocking

CVE-2026-78662 (GO-2026-6354) - CVSS 7.5

• Impact: Malicious peer could flood unestablished channel requests, causing connection deadlock
• Root Cause: Race condition between channel registration and establishment state
• Resolution: Added atomic established state; packets are dropped (not buffered) until channel is ready

Dependency Updates

Package	Previous	Updated
golang.org/x/crypto	v0.54.0	v0.56.0
golang.org/x/net	v0.57.0	v0.58.0
OutSystems chisel fork	v1.11.8-os.2	v1.12.0-os.1

What's Changed

• Security: Upgrade golang.org/x/crypto to v0.56.0 to fix SSH DoS vulnerabilities (#205)

Upgrade Recommendation

⚠️ Recommended for all deployments

These vulnerabilities affect the core SSH tunneling functionality. While exploitation requires an active malicious peer, upgrading is strongly recommended
to prevent potential denial-of-service attacks against your Cloud Connector instances.

Upgrade is seamless - no configuration changes or breaking changes. Simply update the image tag:

v2.1.0

v2.1.0 - HTTP CONNECT Proxy with Security Hardening

Features

• Added embedded HTTP CONNECT proxy for ODC apps to reach private TLS backends by real hostname
• Connection limiting with automatic overflow handling
• Security hardening against connection exhaustion and header-based attacks
• Activity-aware idle timeout for efficient resource management
• Automatic error recovery on transient network issues

New CLI Flags

• --http-proxy - Enable the embedded HTTP CONNECT proxy (opt-in)
• --http-proxy-gateway-port - Proxy gateway port (default: 8080)
• --http-proxy-listen-port - Internal proxy listen port (default: 18080)
• --http-proxy-allow HOST:PORT - Target allowlist (repeatable, recommended approach)
• --http-proxy-allow-all - Allow any target (alternative option)
• --http-proxy-max-conns - Maximum concurrent tunnels (default: 1024)
• --http-proxy-header-timeout - Header read timeout for stability (default: 10s)
• --http-proxy-idle-timeout - Inactive tunnel cleanup timeout (default: 15m)

Security Improvements

• Enhanced protection against slow connection attacks
• Resilient error handling for network instability
• Resource limits to prevent accidental exhaustion
• Improved data integrity during connection transitions

ℹ️ Deployment Guidance for v2.1.0

The HTTP CONNECT proxy is completely optional — if not needed, your deployment works exactly as before.

When enabling the proxy, we recommend:

• Use target allowlist for security: --http-proxy-allow database.internal:5432 --http-proxy-allow api.internal:443
• Monitor file descriptor usage: ulimit -n should be ≥ 2 × max-conns + 256
• Default configuration (1024 max tunnels) requires ulimit -n ≥ 2304

Example secure deployment:

--http-proxy \
  --http-proxy-allow database.corp:5432 \
  --http-proxy-allow api.corp:443 \
  --http-proxy-max-conns 512

⚠️ Important (v2.0.5 and above)

• No shell support (sh/bash not available) as base image changed to Distroless for security reason.
• Deployments using ["/bin/sh"] will fail.

Use Kubernetes variable syntax:
❌ $TOKEN
✅ $(TOKEN)

v2.0.12

• Go version bump and dependency updates for security patching.

• No other functional changes.

  ⚠️ Important (v2.0.5 and above)

  • No shell support (sh/bash not available) as base image changed to Distroless for security reason.
  • Deployments using ["/bin/sh"] will fail.

  Use Kubernetes variable syntax:
  ❌ $TOKEN
  ✅ $(TOKEN)

v2.0.11

###############

• Go version bump and dependency updates for security patching.
• Fix connection leak in fetchURL: removed SetDoNotParseResponse(true) so resty's default body handling closes the
  response body correctly, preventing a socket leak.
• No other functional changes.

⚠️ Important (v2.0.5 and above)

• No shell support (sh/bash not available) as base image changed to Distroless for security reason.
• Deployments using ["/bin/sh"] will fail.

Use Kubernetes variable syntax:
❌ $TOKEN
✅ $(TOKEN)
###############

v2.0.10

• Go version bump and dependency updates for security patching.
• No functional changes.

⚠️ Important (v2.0.5 and above)

• No shell support (sh/bash not available) as base image changed to Distroless for security reason.
• Deployments using ["/bin/sh"] will fail.

Use Kubernetes variable syntax:
❌ $TOKEN
✅ $(TOKEN)

v2.0.9

• Go version bump and dependency updates for security patching.
• No functional changes.

⚠️ Important (v2.0.5 and above)

• No shell support (sh/bash not available) as base image changed to Distroless for security reason.
• Deployments using ["/bin/sh"] will fail.

Use Kubernetes variable syntax:
❌ $TOKEN
✅ $(TOKEN)

v2.0.8

• Go version bump and dependency updates for security patching.
• No functional changes.

⚠️ Important (v2.0.5 and above)

• No shell support (sh/bash not available) as base image changed to Distroless for security reason.
• Deployments using ["/bin/sh"] will fail.

Use Kubernetes variable syntax:
❌ $TOKEN
✅ $(TOKEN)

v2.0.7

• Go version bump and dependency updates for security patching.
• No functional changes.

⚠️ Important (v2.0.5 and above)

• No shell support (sh/bash not available) as base image changed to Distroless for security reason.
• Deployments using ["/bin/sh"] will fail.

Use Kubernetes variable syntax:
❌ $TOKEN
✅ $(TOKEN)

v2.0.6

• Go version bump and dependency updates for security patching.
• No functional changes.

⚠ Important (v2.0.5 and above)

• No shell support (sh/bash not available) as base image changed to Distroless for security reason.
• Deployments using ["/bin/sh"] will fail.

Use Kubernetes variable syntax:
❌ $TOKEN
✅ $(TOKEN)

v2.0.5

Security: Go version bump and dependency updates for security patching

Base Image Change

Migrated from Alpine to Distroless to mitigate HIGH severity CVEs in Alpine (no fixed packages available at time of release).
This doesn't change any functionality of app.

Breaking Change - Deployment Configuration

Since Distroless, No shell available - sh and bash do not exist. Deployments using command: ["/bin/sh"] will fail.

Environment Variables

Use Kubernetes variable syntax - For environment variables, use $(VARIABLE) not $VARIABLE:

❌ $TOKEN (requires shell)
✅ $(TOKEN) (Kubernetes expands this)