-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 31 Aug 2026 20:53:27 +0100 Source: openssh Architecture: source Version: 1:10.5p1-1 Distribution: unstable Urgency: medium Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org> Changed-By: Colin Watson <cjwatson@debian.org> Closes: 1144192 Changes: openssh (1:10.5p1-1) unstable; urgency=medium . * New upstream release (closes: #1144192): - CVE-2026-73281: ssh-agent(1): fix an interaction between agent locking and the session-bind@openssh.com extension that is used to identify forwarded agents. These binding requests were refused when the agent was locked, with the result that operations that were intended to be limited to local use only could be performed remotely, including the ability to add PKCS#11 tokens and make use of keys that had destination restrictions applied. - CVE-2026-73282: ssh(1): avoid potential realloc use-after-free in the client if a remote forwarding is added via the local session multiplexing socket while a remote forwarding open request is pending with the server. - CVE-2026-73283: sshd(8): make the authorized_keys "restrict" keyword apply correctly to tunnel forwarding too (which is administratively disabled by default). - ssh-keygen(1): add ability to set or clear the touch-required and verify-required flags on FIDO private keys when resetting a private key's passphrase. - ssh(1): tweak ordering of certificates tried during pubkey authentication to prefer FIDO keys that do not require user presence (touch) first, and FIDO keys that require user verification via PIN or biometrics last. This effectively tries low-friction authenticators before higher friction ones. - ssh(1): add a "ssh -Z user@host" mode that prints the keys that will be tried for public key authentication in the order that they will be used. - sshd(8) use setproctitle(3) to identify sshd-session when it's acting as a post-authentication monitor. - ssh-keyscan(1): make reading the server banner a non-blocking operation to prevent a stuck server from blocking a many-host keyscan from proceeding. - sshd(8): use sshpkt_fatal() instead of plain fatal() for errors in the packet code as this provides context of the failing peer (address, port, user, etc). - sshd(8): when signing hostkey proofs for a client UpdateHostKeys request, allow each hostkey to perform at most one signature operation. - ssh-keygen(1): pass back errors from ed25519 key generation, which theoretically can fail. - sshd(8): move check of public key type against allowed algorithms to before parsing of the key sent by the peer. This removes at least some key parsing and verification paths from the pre-auth attack surface. - ssh-keygen(1): fix double frees (impossible to reach outside of a test harness), and also use freezero where possible. - sshd(8): fix ChannelTimeout and RekeyLimit not being applied in sshd_config Match blocks. - sshd(8): in sshd config dump mode, write all directives in mixed case for consistency. - sshd(8): re-allow PAMServiceName inside a Match block, which was incorrectly disabled during a refactoring in openssh-10.4. Checksums-Sha1: 1a0c61774dc20674828e4aed57fb3069aa2fb03e 3372 openssh_10.5p1-1.dsc 008850ac30739d6425cc782106238abbb74cd859 1632424 openssh_10.5p1.orig.tar.xz d2a2b743ca3f52b38c7b49d4d781f03f8b4a015a 186560 openssh_10.5p1-1.debian.tar.xz e1cd79d9cf317944d838689eea6f8ee0215dc5fa 5341740 openssh_10.5p1-1.git.tar.xz 8a800dd46ddb541bd8d493c07be84a10c26700ad 17674 openssh_10.5p1-1_source.buildinfo Checksums-Sha256: 15a621f5d4c298127b57740e271ef571760686133f344a4841aa8e96af0ad532 3372 openssh_10.5p1-1.dsc 9643e644c20dfef1271eaccc488ae4cebc9b5352b800c30771233880d985c74c 1632424 openssh_10.5p1.orig.tar.xz 4b19dea2fc78e93687d7f9e103542136d863e3d5c95e7d7be6088ac7979fb0cc 186560 openssh_10.5p1-1.debian.tar.xz e4b36f4d32ecf12fd7d0e7fa9277f8219d05aa2bbb24407ce5ea5c34b3866be1 5341740 openssh_10.5p1-1.git.tar.xz e98487aea017c83e4e6fe231975241586e5e59a5df530a68393f673217df81ff 17674 openssh_10.5p1-1_source.buildinfo Files: 5ad66c933e21c32ee28c104945f293a3 3372 net standard openssh_10.5p1-1.dsc 78cd1f0ed8593dccc747185e6eaa9f85 1632424 net standard openssh_10.5p1.orig.tar.xz 382c044c2a378c229e35961b1440568a 186560 net standard openssh_10.5p1-1.debian.tar.xz fb4f1883a7d9044bb1d36d00920447ab 5341740 net standard openssh_10.5p1-1.git.tar.xz feb9577324b8413ec70d5399bd52c388 17674 net standard openssh_10.5p1-1_source.buildinfo Git-Tag-Info: tag=55ac9c3d5b472bef5025f867b8ba0a39ba07ec48 fp=ac0a4ff12611b6fccf01c111393587d97d86500b Git-Tag-Tagger: Colin Watson <cjwatson@debian.org> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqV3JgACgkQYG0ITkaD wHnC9hAAsOzMV7ACyYGj/slN4HfwNW3jwCys/ZrLnVGPrnRg4U6B+8njIIRktfHr i2qgY7U9/QkJd3cwdRXQx3CTwk5UfZQAmcFKna0cZGq+QJuWL5uE67FKPC7HGaC+ uHgqYzCOxsxt9nS11q8R51DzilbpcI1ihv2Mz0q4M47/AwKicCXJoGjfSqBjxhjY UhrJF2nEEKBFbEx3DX7C2bJFBzG7kv8m5/HhRF59YBw2YuBxxi9/hRfKH0Ym0uxB PMDUEFtSFDoH9PIqju/spKHGfzzDnLfLZz6XnqCmXQDoIgJXGdzjL+7pzLHjAJkd HlhQjthHmBDN6tXgAnPNxsqyWGUZ2dmfyei2cuoD87Rmr9Xo3kJrzJSb6BLhhNxu KEkYaASHgBHI0JPyQWRw/EIpWU8O5ABXWvsC5HXp/qJVwqhFNXdv7r9KDKd+ek/W ditzwUp+BFl2H32aiWbybvpYxmPhagwRFwgDwKk+lIZwwXfK8H9l7UM+8xhVGAb3 Uur/4CWb376wX7P1I23UhuKY7f1ny/LvaOPm76N/JHzdetdkY8ub4LFqAA6JjAiZ huUVgK+IaAkoSg9UAym2mq0qNzLIVNQHoeesDGsWGEKM9ptXtU3/MqnYXRhdZvJ0 yiEkcu+mV5Jq3EVG7BPfRbrnmdFsFl+mCkGwhYfMcQ4LYXncxp4= =nLdL -----END PGP SIGNATURE-----
