diff mbox series

openssh: Update to version 10.6p2

Message ID 20261105171018.3102903-1-adolf.belka@ipfire.org
State New
Headers
Series openssh: Update to version 10.6p2 |

Commit Message

Adolf Belka 5 Nov 2026, 5:10 p.m. UTC 
- Update from version 10.6p1 to 10.6p2
- No change in rootfile
- 1 Security bug fix but the bug is only on systems using musl libc and does not occur
   on Linux.glibc systems, so it is not a vulnerability for IPFire.
- Changelog
10.6p2
    Future deprecation notice
	 * scp(1): begin deprecating the -R flag, which is used to perform a
	   remote-to-remote copy by executing scp on a remote host. This
	   option is a fragile optimisation that is difficult to use because
	   it requires credentials on the remote host. It also creates
	   security risks if the shell quoting rules on the remote system
	   where the copy is performed differ from the client's expectations.
	   From OpenSSH 10.6, this option will continue to work but will
	   cause a deprecation warning to be emitted to standard error. In
	   a future release, the option will be ignored and will leave in
	   place the default remote-to-remote copy behaviour (copy via the
	   host running scp).
	 * sshd(8): support for platforms that do not allow file descriptor
	   passing and that also require root privilege for PTY allocation
	   will be removed in a future release. Affected platforms are known
	   to include SCO OpenServer 5 and QNX 6 but may include other
	   similarly old operating systems. This deprecation can be avoided
	   if the user community for these platforms is able to assist us in
	   building alternatives, such as avoiding the need for root in PTY
	   allocation.
    Security
	This release contains a critical security workaround that affects
	Linux systems that use the musl libc and PAM disabled.
	 * sshd(8): avoid password authentication bypass that is exploitable
	   through sshd(8) that affects some Linux systems when built and run
	   with PAM support disabled. We consider the root cause of this bug
	   to be outside sshd, but it is exploitable via sshd and can be
	   avoided there.
	   This bug was reported by Özgün Kültekin of Wakefield
	   (wakefield.co)
    Bugfixes
	 * sshd(8), ssh(1): enable the post-quantum hybrid signature scheme
	   ssh-mldsa44-ed25519 as an allowed CA signature algorithm.
	 * ssh(1), sshd(8): fix <1 second CPU spin if ChannelTimeout was in
	   use.
    Portability
	 * sshd(8): fix compilation on (old) platforms that set SKIP_PRIVDROP
	 * ssh(1), sshd(8): fix detection of Azerbaijani locales
	 * sshd(8), ssh-agent(1): fix creation of agent sockets on platforms
	   without the openat(2) syscall.
	 * ssh(1), ssh-add(1), ssh-keygen(1): fix some strange behaviour if
	   SIGINT/SIGQUIT was received while reading a passphrase.
	 * sshd(8): allow restart_syscall(2) in seccomp sandbox; bz4036

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/openssh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/lfs/openssh b/lfs/openssh
index 092fafa1c..2353e6d0c 100644
--- a/lfs/openssh
+++ b/lfs/openssh
@@ -24,7 +24,7 @@ 
 
 include Config
 
-VER        = 10.6p1
+VER        = 10.6p2
 
 THISAPP    = openssh-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@  objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 9ccb92fde6319f00373f38d27c9fbd6802c7b94bdf881bacecbace1676ef9909213f70be99184c5f9cdda06c9192196acb56503c5965d4d50ef1c701b029d06d
+$(DL_FILE)_BLAKE2 = be4ecff2d1b72c7836a7e324b4eb68edcd0bfb4d83b8969fed97ba437c3c72df97c44db0ed9d323677b4bec4681ebcc06935824ce399faa217148bb4b518d739
 
 install : $(TARGET)