ancwrd1/snx-rs v6.6.1

Version 6.6.1

on GitHub

Security

• The service loads a PKCS11 driver only by library name, or from an absolute path that only root (Linux, macOS) or administrators (Windows) can modify. Before, any user allowed to send commands to the service could make it load an arbitrary library with elevated privileges. On Windows, the driver must be given as a full path.
• Linux: the service accepts commands only from root, its own user, users logged in on a local seat (through logind or elogind) and members of the optional snx-rs group. Before, any local user could connect to the service. Users of systems without logind or elogind, or of snxctl over SSH, must be added to the snx-rs group, see Troubleshooting.