From patchwork Thu Nov 5 17:10:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10696 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4jL82W0YTdz3wk8 for ; Thu, 05 Nov 2026 17:10:27 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jL82V1dwhz6mB for ; Thu, 05 Nov 2026 17:10:26 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jL82V0thfz32N0 for ; Thu, 05 Nov 2026 17:10:26 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jL82R3KFMz2xLm for ; Thu, 05 Nov 2026 17:10:23 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4jL82P6Tjkz4ZC; Thu, 05 Nov 2026 17:10:21 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1793898622; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Q1xNL/WWUOQdfwOna2C3yp+8b3aWGebpREz1NYI+2gE=; b=NEyfxQTXg1ADwgjcSs75veKKAlHmEnkFHvN0eoh3AXOVxkT7v7PIRYiNuNWBBFo9jWaa7t 19owElp0Gzr6VjCA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1793898622; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Q1xNL/WWUOQdfwOna2C3yp+8b3aWGebpREz1NYI+2gE=; b=CEdkCObAJngpxcVgE41wMr1HN9T7ZS4Yz6cf2obGQ8GBAI47exOuOnqRo4R13GsZx5to4M p58g3H0s/7jXhExYPomcaBQpffYCdlpwljKtDLZYnso7XntpyvCGQm8IaRNjlP8D5JTdej YesbX+XJEUXuaYVNp8jGU/vxtLN85yQx+Y4Wy2eQlQ4jEko1MkaiFKgl1ToibvNZ55r2yJ A+RpxP+SeT05q+KQp3CiDG7EPVtrYqaC/vOovaM9Elak9lwWwD/6UJoYKOzhCMd9RjJnuw gxW5YWBCxU80p+yn/B6kUZykTHW9iaHVdagfidJjtvwVYk9ZnelDGhkP4g1ABg== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] openssh: Update to version 10.6p2 Date: Thu, 5 Nov 2026 18:10:17 +0100 Message-ID: <20261105171018.3102903-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 10.6p1 to 10.6p2 - No change in rootfile - 1 Security bug fix but the bug is only on systems using musl libc and does not occur on Linux.glibc systems, so it is not a vulnerability for IPFire. - Changelog 10.6p2 Future deprecation notice * scp(1): begin deprecating the -R flag, which is used to perform a remote-to-remote copy by executing scp on a remote host. This option is a fragile optimisation that is difficult to use because it requires credentials on the remote host. It also creates security risks if the shell quoting rules on the remote system where the copy is performed differ from the client's expectations. From OpenSSH 10.6, this option will continue to work but will cause a deprecation warning to be emitted to standard error. In a future release, the option will be ignored and will leave in place the default remote-to-remote copy behaviour (copy via the host running scp). * sshd(8): support for platforms that do not allow file descriptor passing and that also require root privilege for PTY allocation will be removed in a future release. Affected platforms are known to include SCO OpenServer 5 and QNX 6 but may include other similarly old operating systems. This deprecation can be avoided if the user community for these platforms is able to assist us in building alternatives, such as avoiding the need for root in PTY allocation. Security This release contains a critical security workaround that affects Linux systems that use the musl libc and PAM disabled. * sshd(8): avoid password authentication bypass that is exploitable through sshd(8) that affects some Linux systems when built and run with PAM support disabled. We consider the root cause of this bug to be outside sshd, but it is exploitable via sshd and can be avoided there. This bug was reported by Özgün Kültekin of Wakefield (wakefield.co) Bugfixes * sshd(8), ssh(1): enable the post-quantum hybrid signature scheme ssh-mldsa44-ed25519 as an allowed CA signature algorithm. * ssh(1), sshd(8): fix <1 second CPU spin if ChannelTimeout was in use. Portability * sshd(8): fix compilation on (old) platforms that set SKIP_PRIVDROP * ssh(1), sshd(8): fix detection of Azerbaijani locales * sshd(8), ssh-agent(1): fix creation of agent sockets on platforms without the openat(2) syscall. * ssh(1), ssh-add(1), ssh-keygen(1): fix some strange behaviour if SIGINT/SIGQUIT was received while reading a passphrase. * sshd(8): allow restart_syscall(2) in seccomp sandbox; bz4036 Signed-off-by: Adolf Belka --- lfs/openssh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/openssh b/lfs/openssh index 092fafa1c..2353e6d0c 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -24,7 +24,7 @@ include Config -VER = 10.6p1 +VER = 10.6p2 THISAPP = openssh-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 9ccb92fde6319f00373f38d27c9fbd6802c7b94bdf881bacecbace1676ef9909213f70be99184c5f9cdda06c9192196acb56503c5965d4d50ef1c701b029d06d +$(DL_FILE)_BLAKE2 = be4ecff2d1b72c7836a7e324b4eb68edcd0bfb4d83b8969fed97ba437c3c72df97c44db0ed9d323677b4bec4681ebcc06935824ce399faa217148bb4b518d739 install : $(TARGET)