-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Tue, 20 Jun 2023 01:01:48 +0100 Source: openssh Architecture: source Version: 1:9.3p1-1 Distribution: unstable Urgency: medium Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org> Changed-By: Colin Watson <cjwatson@debian.org> Closes: 909022 959726 1001186 1033166 1033178 1034425 Changes: openssh (1:9.3p1-1) unstable; urgency=medium . * Debconf translations: - Romanian (thanks, Remus-Gabriel Chelu; closes: #1033178). * Properly fix date of 1:3.0.2p1-2 changelog entry (closes: #1034425). * New upstream release (https://www.openssh.com/releasenotes.html#9.3p1): - [CVE-2023-28531] ssh-add(1): when adding smartcard keys to ssh-agent(1) with the per-hop destination constraints (ssh-add -h ...) added in OpenSSH 8.9, a logic error prevented the constraints from being communicated to the agent. This resulted in the keys being added without constraints. The common cases of non-smartcard keys and keys without destination constraints are unaffected. This problem was reported by Luci Stanescu (closes: #1033166). - [SECURITY] ssh(1): Portable OpenSSH provides an implementation of the getrrsetbyname(3) function if the standard library does not provide it, for use by the VerifyHostKeyDNS feature. A specifically crafted DNS response could cause this function to perform an out-of-bounds read of adjacent stack data, but this condition does not appear to be exploitable beyond denial-of-service to the ssh(1) client. - ssh-keygen(1), ssh-keyscan(1): accept -Ohashalg=sha1|sha256 when outputting SSHFP fingerprints to allow algorithm selection. - sshd(8): add a `sshd -G` option that parses and prints the effective configuration without attempting to load private keys and perform other checks. This allows usage of the option before keys have been generated and for configuration evaluation and verification by unprivileged users. - scp(1), sftp(1): fix progressmeter corruption on wide displays. - ssh-add(1), ssh-keygen(1): use RSA/SHA256 when testing usability of private keys as some systems are starting to disable RSA/SHA1 in libcrypto. - sftp-server(8): fix a memory leak. - ssh(1), sshd(8), ssh-keyscan(1): remove vestigial protocol compatibility code and simplify what's left. - Fix a number of low-impact Coverity static analysis findings. - ssh_config(5), sshd_config(5): mention that some options are not first-match-wins. - Rework logging for the regression tests. Regression tests will now capture separate logs for each ssh and sshd invocation in a test. - ssh(1): make `ssh -Q CASignatureAlgorithms` work as the manpage says it should. - ssh(1): ensure that there is a terminating newline when adding a new entry to known_hosts. - sshd(8): harden Linux seccomp sandbox. Move to an allowlist of mmap(2), madvise(2) and futex(2) flags, removing some concerning kernel attack surface. * debian/README.Debian: Clarify that you need to restart ssh.socket after overriding its ListenStream= option (LP: #2020560). * debian/openssh-server.postinst: Use "sshd -G" to parse the server configuration file (closes: #959726). * Fix incorrect RRSET_FORCE_EDNS0 flags validation in SSHFP DNSSEC patch (thanks, Ben Hutchings; closes: #909022). * Always use the internal mkdtemp implementation, since it substitutes more randomness into the template string than glibc's version (closes: #1001186). Checksums-Sha1: ab3a7ebc6246958e15896b814213ca3e6a612f63 3312 openssh_9.3p1-1.dsc 610959871bf8d6baafc3525811948f85b5dd84ab 1856839 openssh_9.3p1.orig.tar.gz 31e40d5a0769d4febc8493f354b273eff0d9cab5 833 openssh_9.3p1.orig.tar.gz.asc b989715aa2088f32af0845b5fb6a116e80598028 183616 openssh_9.3p1-1.debian.tar.xz Checksums-Sha256: a16311299ca945c2818aa4a4f2847c70a68eb3a677cfef1efd2837c4ba05faff 3312 openssh_9.3p1-1.dsc e9baba7701a76a51f3d85a62c383a3c9dcd97fa900b859bc7db114c1868af8a8 1856839 openssh_9.3p1.orig.tar.gz 6d96d2ff60d8d3545f0fa1709cb4c273d9a2fe086afa90f70951cffc01c8fa68 833 openssh_9.3p1.orig.tar.gz.asc 523656c543f08138ad65665020b34ec157fefc0117bf8b81fbea57655b73e463 183616 openssh_9.3p1-1.debian.tar.xz Files: 6bda98b24abb25577ce0cdd42ac849da 3312 net standard openssh_9.3p1-1.dsc 3430d5e6e71419e28f440a42563cb553 1856839 net standard openssh_9.3p1.orig.tar.gz 8a1aef9314a4224cf3f2936430733796 833 net standard openssh_9.3p1.orig.tar.gz.asc 9ce700b7d9908a542ffdb28dab37387a 183616 net standard openssh_9.3p1-1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEErApP8SYRtvzPAcEROTWH2X2GUAsFAmSQ7KYACgkQOTWH2X2G UAs68w/9HBZKKTXOJK+jOGfomE3XmqZUBgbSHv2hw6m9lk3PwudZWbfOpSBY5WY2 8k2FP8XbztxAevBizoPzC17+autWXxZtAsOlJaNElZRYBPQNuKDCg8GlMkI0v6M3 iu4UPx5FDuULyle8a5VZ995LXjrCzJni4KUDR7MFb0p8Qm+JaBBhMG39273C695e AvdIdbh8l/Gk86ug11sb4+YSaUfkLuN/kD98TrVzYBtwpDGCaKJ8mBPiF3hMC2Og LUpXnFvOMFC154y2XN5S27TrkLzOW8m8nUssfna0yVgcdMDOU9ymhPPeTNxe1Wpr hMQBqyQnDvrIrYTRVx5z0fECR5YZv3vUyYWiUYsLWN53EEX0XUjcDozsnMwCqOHk dsqZoX81sBRYeIgOLJMqkKHY59h1IeZBXxlkqdUnUiJdRoFaaWcBNHoKpLIpu5Gj clLHIjAlmAy+MVTi0Fx88X142DRnKYm9yckVOZo1jMcYpYVITrqK44e/X/dd+/nT P79zRydRNcwdJnGLAy4rdF4oJwhLq+v05F6I75gYdRl6W5aEB3rTb7IfhC+PMTfi +RchHBKALvzo/1Cbv+TU0hVbdsq0RmEF4q2+uC03XjdGMTutX6EDLi5UcaSeDCbI wwgrEYvnLc74t2sNDjzGu6dY/YfmEKAbN8snWgRag9J/bbrDQi0= =v5AT -----END PGP SIGNATURE-----
