From patchwork Thu Aug 13 13:39:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10146 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hLRSC6WPbz3wqM for ; Thu, 13 Aug 2026 13:44:59 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hLRS359Ctz7TG for ; Thu, 13 Aug 2026 13:44:51 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hLRMV0Hvvz37Hs for ; Thu, 13 Aug 2026 13:40:54 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hLRMR1tfDz2xMg for ; Thu, 13 Aug 2026 13:40:51 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hLRMH0TV2z14q; Thu, 13 Aug 2026 13:40:43 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1786628443; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=v9Mq7m1oHbHBmSmk/se1RUDYgyfsckLSFrfOlvq+fXI=; b=PWCXDc9dEB6bQtznS9PkfJJly5GfNE3qR9usWUnZxIlj105qQwJUKDj9mKFuzRkpVolEtW MZAUB2xFHjDAvCBQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1786628443; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=v9Mq7m1oHbHBmSmk/se1RUDYgyfsckLSFrfOlvq+fXI=; b=WCl1UxWd3Uv2pGcja5iJjLwTAnXsy6hyfwRVLIzG6BLBZmVTDIlXyOjz2FApWQluoGLeDI Zrje7b5sPkJi0T5jVZ/f2DnrAcGnpkxUgxAQiYeuxLICQKy8noEFNXa05a9L75cKUNXH3X KFEBjBqrohsCDsYq1TWD3pm+PkrV0CClEPGgWAla/bqq0JMccp+N+k/pGBuCgHGlnGjrr7 jw2l04OdvtZG/qNTwZwSpLTXep7D1s9rZLfs2YXiCRs9CjPgh2T93MhYjiZOEXZwVa3M6/ o1Y8ajA+zLeMor4jueRykPQa1joMZlCMaGKgf8JQJsWBGhcRpjIRmv/1DeGtLg== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] openssh: Update to version 10.5p1 Date: Thu, 13 Aug 2026 15:39:37 +0200 Message-ID: <20260813133942.2669472-8-adolf.belka@ipfire.org> In-Reply-To: <20260813133942.2669472-1-adolf.belka@ipfire.org> References: <20260813133942.2669472-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 10.4p1 to 10.5p1 - No change in rootfile - Changelog 10.5p1 Potentially-incompatible changes * Portable OpenSSH now requires ECC (Elliptic Curve Cryptography) support in libcrypto, including support for the NISTP521 curve. ECC is included in the default build configurations of all versions of all libcrypto implementations currently supported by OpenSSH, including LibreSSL, OpenSSL, BoringSSL and AWS LC. The --without-openssl build configuration is not affected. Security * ssh-agent(1): fix an interaction between agent locking and the session-bind@openssh.com extension that is used to identify forwarded agents. These binding requests were refused when the agent was locked, with the result that operations that were intended to be limited to local use only could be performed remotely, including the ability to add PKCS#11 tokens and make use of keys that had destination restrictions applied. Reported by sn0x-sharma * ssh(1): avoid potential realloc use-after-free in the client if a remote forwarding is added via the local session multiplexing socket while a remote forwarding open request is pending with the server. Report and fix from Brian Mingus of Cognatory * sshd(8): make the authorized_keys "restrict" keyword apply correctly to tunnel forwarding too (which is administratively disabled by default). Reported by Erichen, Institute of Computing Technology, Chinese Academy of Sciences New features * ssh-keygen(1): add ability to set or clear the touch-required and verify-required flags on FIDO private keys when resetting a private key's passphrase. * ssh(1): tweak ordering of certificates tried during pubkey authentication to prefer FIDO keys that do not require user presence (touch) first, and FIDO keys that require user verification via PIN or biometrics last. This effectively tries low-friction authenticators before higher friction ones. * ssh(1): add a "ssh -Z user@host" mode that prints the keys that will be tried for public key authentication in the order that they will be used. * sshd(8) use setproctitle(3) to identify sshd-session when its acting as a post-authentication monitor. Bugfixes * ssh-keyscan(1): make reading the server banner a non-blocking operation to prevent a stuck server from blocking a many-host keyscan from proceeding. * sshd(8): use sshpkt_fatal() instead of plain fatal() for errors in the packet code as this provides context of the failing peer (address, port, user, etc). * sshd(8): when signing hostkey proofs for a client UpdateHostKeys request, allow each hostkey to perform at most one signature operation. * sshd(8) fix GSSAPI option names, that were broken during a servconf.c refactoring in openssh-10.4; bz3974. * ssh-keygen(1): pass back errors from ed25519 key generation, which theoretically can fail. GHPR702. * sshd(8): move check of public key type against allowed algorithms to before parsing of the key sent by the peer. This removes at least some key parsing and verification paths from the pre-auth attack surface. Suggested by Christopher Paul Rohlf of Anthropic. * ssh-keygen(1): fix double frees (impossible to reach outside of a test harness), and also use freezero where possible. From Christopher Paul Rohlf at Anthropic. * sshd(8): fix ChannelTimeout and RekeyLimit not being applied in sshd_config Match blocks. * sshd(8): in sshd config dump mode, write all directives in mixed case for consistency Portability * sshd(8): re-allow PAMServiceName inside a Match block, which was incorrectly disabled during a refactoring in openssh-10.4. bz3987 Signed-off-by: Adolf Belka --- lfs/openssh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/openssh b/lfs/openssh index e7acb2058..a792df365 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -24,7 +24,7 @@ include Config -VER = 10.4p1 +VER = 10.5p1 THISAPP = openssh-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 3051a345fd24333708277a1de781deca9094dd07cc55e613e93715b1266d80d59043bf5cdb2282d02c797cb9446916020e70fbd4c7a2470da7ab98eb612f6b74 +$(DL_FILE)_BLAKE2 = 8e8be4e4aff6b5f16e19f85b994fcc9b7679021cf639fad4323dc15f6bc0041b45370024a5f51065e2a92d965428cf3787323957f2c41f4d27fc1146dc3690cf install : $(TARGET)