-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Wed, 31 Jul 2024 17:16:04 +0100 Source: openssh Architecture: source Version: 1:9.8p1-1 Distribution: unstable Urgency: medium Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org> Changed-By: Colin Watson <cjwatson@debian.org> Closes: 1037515 1068044 1073065 Changes: openssh (1:9.8p1-1) unstable; urgency=medium . * New upstream release (https://www.openssh.com/releasenotes.html#9.8p1): - CVE-2024-39894: Fix Logic error in ssh(1) ObscureKeystrokeTiming that made the feature ineffective. - The DSA signature algorithm is now disabled at compile-time. - sshd(8): the server has been split into a listener binary, sshd(8), and a per-session binary "sshd-session". This allows for a much smaller listener binary, as it no longer needs to support the SSH protocol. As part of this work, support for disabling privilege separation (which previously required code changes to disable) and disabling re-execution of sshd(8) has been removed. Further separation of sshd-session into additional, minimal binaries is planned for the future. - sshd(8): several log messages have changed. In particular, some log messages will be tagged with as originating from a process named "sshd-session" rather than "sshd". - ssh-keyscan(1): this tool previously emitted comment lines containing the hostname and SSH protocol banner to standard error. This release now emits them to standard output, but adds a new "-q" flag to silence them altogether. - sshd(8): sshd will no longer use argv[0] as the PAM service name. A new "PAMServiceName" sshd_config(5) directive allows selecting the service name at runtime. This defaults to "sshd". - sshd(8): penalise client addresses that, for various reasons, do not successfully complete authentication. This feature is controlled by a new sshd_config(5) PerSourcePenalties option and is on by default. - ssh(8): allow the HostkeyAlgorithms directive to disable the implicit fallback from certificate host key to plain host keys. - misc: fix a number of inaccuracies in the PROTOCOL.* documentation files. - all: switch to strtonum(3) for more robust integer parsing in most places. - ssh(1), sshd(8): correctly restore sigprocmask around ppoll(). - ssh-keysign(8): stricter validation of messaging socket fd. - sftp(1): flush stdout after writing "sftp>" prompt when not using editline. - sftp-server(8): fix home-directory extension implementation, it previously always returned the current user's home directory contrary to the spec. - ssh-keyscan(1): do not close stdin to prevent error messages when stdin is read multiple times. - regression tests: fix rekey test that was testing the same KEX algorithm repeatedly instead of testing all of them. - ssh_config(5), sshd_config(5): clarify the KEXAlgorithms directive documentation, especially around what is supported vs available (closes: #1073065). - sshd(8): expose SSH_AUTH_INFO_0 always to PAM auth modules unconditionally. The previous behaviour was to expose it only when particular authentication methods were in use. - build: fix OpenSSL ED25519 support detection. An incorrect function signature in configure.ac previously prevented enabling the recently added support for ED25519 private keys in PEM PKCS8 format. - ssh(1), ssh-agent(8): allow the presence of the WAYLAND_DISPLAY environment variable to enable SSH_ASKPASS, similarly to the X11 DISPLAY environment variable (closes: #1037515, #1068044). * Stop generating DSA host key. * Apply X-Style: black. Checksums-Sha1: 9e7b47f6224e5d36ac447b5161b93ebdb2122e68 3313 openssh_9.8p1-1.dsc a0bb501b11349f5c5c33a269351be091dc2c2727 1910393 openssh_9.8p1.orig.tar.gz 2c8addecb3c6af8b3eb36742d2f6c66b8281c5c9 833 openssh_9.8p1.orig.tar.gz.asc 33d1b8fdf605a872289623e021e1eaf936471a82 192700 openssh_9.8p1-1.debian.tar.xz Checksums-Sha256: a2bd13155bede2b39431455fa618375c8c157792540d6ffa7784904cbb28dc59 3313 openssh_9.8p1-1.dsc dd8bd002a379b5d499dfb050dd1fa9af8029e80461f4bb6c523c49973f5a39f3 1910393 openssh_9.8p1.orig.tar.gz dbb65803565909f2c541db9b45385249cacbf021a0cd4189836bff5c3832d4b9 833 openssh_9.8p1.orig.tar.gz.asc bb4eb99907e717d58feff8160eb13ab1781c6e65ec79e341a077683c4751a135 192700 openssh_9.8p1-1.debian.tar.xz Files: a29955456fdef53ed4ce186131e3a34b 3313 net standard openssh_9.8p1-1.dsc bc04ff77796758c0b37bd0bc9314cd3f 1910393 net standard openssh_9.8p1.orig.tar.gz 5f6e7e04252b58565d60faf55c126208 833 net standard openssh_9.8p1.orig.tar.gz.asc e35f283e82ddb5fcd90041404c3b1701 192700 net standard openssh_9.8p1-1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEErApP8SYRtvzPAcEROTWH2X2GUAsFAmaqY4YACgkQOTWH2X2G UAubpw/+Kn0wH+06mI75aMwxtD2/P0j2Ai94WTKkq4HF1k02aykaxiPrXsLkcEUL 1+K5nXcaoEk7ekqZkpgPUQfaFSErzvgSAFjXmiIJlzmk0jY+lH/e00uRMiIvroK6 1ASyVHV2jDA0WZ0EsdjriWxawSj+5J6+GKUpQNZSgmEXLScAQLgTnXKZg++jju8l Lg2adC9EGMs1E5aySydcZuIsqqB9TVlFTujYNjfXfvJkM9CBxtRaD50rsYK1Hqvd k6rRJO+g14auM8HOuXfSQxcdQol46YTjJJWgPapn9CmvOp3btz8pCFboNh433VRh zKExwiYJrnh0AYJRuWRHzJ55xpcsmtKME8SqNkA2k5pDIEVnU1R2sqkArrfXqYRh 3vhYsnKC7QxRGORKLlEzTjLS4mrDAWEKXWnCLanulYG2skEPkBENwhphrx5HRFOn HJ+HHzOCdvOF13p+c7d8Ymzq2WXsPunEYf8JGMChFuD/dl4GDOL6NdwkHT10M9lT mngY/u9Nrom4ANR9FjEcE5mjLFQnhO9IclVAfhrl39uyHHMgVhRgSs8qUBN9LQ+U e0r+/KPAS/fqDpbxPun6E7mPcDePFkSruyx8fJZWtmOqGOLJ8DouD2Bn48zngQP5 ryvb5q1oECl/4/snEBs3K7X9IBr5ZxbT4IZaK6tn+c5FJNUD2m8= =/4Ui -----END PGP SIGNATURE-----
