-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 31 Aug 2026 23:45:36 +0100 Source: openssh-gssapi Architecture: source Version: 1:10.5p1-1 Distribution: unstable Urgency: medium Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org> Changed-By: Colin Watson <cjwatson@debian.org> Closes: 1144192 Changes: openssh-gssapi (1:10.5p1-1) unstable; urgency=medium . * password-auth-no-pam: Run test daemon via systemd. * New upstream release (closes: #1144192): - CVE-2026-73281: ssh-agent(1): fix an interaction between agent locking and the session-bind@openssh.com extension that is used to identify forwarded agents. These binding requests were refused when the agent was locked, with the result that operations that were intended to be limited to local use only could be performed remotely, including the ability to add PKCS#11 tokens and make use of keys that had destination restrictions applied. - CVE-2026-73282: ssh(1): avoid potential realloc use-after-free in the client if a remote forwarding is added via the local session multiplexing socket while a remote forwarding open request is pending with the server. - CVE-2026-73283: sshd(8): make the authorized_keys "restrict" keyword apply correctly to tunnel forwarding too (which is administratively disabled by default). - ssh-keygen(1): add ability to set or clear the touch-required and verify-required flags on FIDO private keys when resetting a private key's passphrase. - ssh(1): tweak ordering of certificates tried during pubkey authentication to prefer FIDO keys that do not require user presence (touch) first, and FIDO keys that require user verification via PIN or biometrics last. This effectively tries low-friction authenticators before higher friction ones. - ssh(1): add a "ssh -Z user@host" mode that prints the keys that will be tried for public key authentication in the order that they will be used. - sshd(8) use setproctitle(3) to identify sshd-session when it's acting as a post-authentication monitor. - ssh-keyscan(1): make reading the server banner a non-blocking operation to prevent a stuck server from blocking a many-host keyscan from proceeding. - sshd(8): use sshpkt_fatal() instead of plain fatal() for errors in the packet code as this provides context of the failing peer (address, port, user, etc). - sshd(8): when signing hostkey proofs for a client UpdateHostKeys request, allow each hostkey to perform at most one signature operation. - ssh-keygen(1): pass back errors from ed25519 key generation, which theoretically can fail. - sshd(8): move check of public key type against allowed algorithms to before parsing of the key sent by the peer. This removes at least some key parsing and verification paths from the pre-auth attack surface. - ssh-keygen(1): fix double frees (impossible to reach outside of a test harness), and also use freezero where possible. - sshd(8): fix ChannelTimeout and RekeyLimit not being applied in sshd_config Match blocks. - sshd(8): in sshd config dump mode, write all directives in mixed case for consistency. - sshd(8): re-allow PAMServiceName inside a Match block, which was incorrectly disabled during a refactoring in openssh-10.4. Checksums-Sha1: d2b61f61659206c60c1d27c44ae1d26ee7a0fe2c 2971 openssh-gssapi_10.5p1-1.dsc e977a002fdff1d065e81c436b929e7e255c4286e 1632904 openssh-gssapi_10.5p1.orig.tar.xz 69a811f167449a949b0e1b086381395964882822 199088 openssh-gssapi_10.5p1-1.debian.tar.xz 2789546535adf5d1619b3a09471b2c35062cc1bf 5350264 openssh-gssapi_10.5p1-1.git.tar.xz f43c4c904b7d0993ad77270f90756e044637e097 17702 openssh-gssapi_10.5p1-1_source.buildinfo Checksums-Sha256: 86207a0b2b87fd347af580dc90e40c0bdc0259822ddda3910c43c4a0eac209c8 2971 openssh-gssapi_10.5p1-1.dsc 0a6257ccf7a3ec7b7da29b78c3f67287e55e88f0f88ba982afbab524ab9555f1 1632904 openssh-gssapi_10.5p1.orig.tar.xz a9bfec7c61caa99600712abcd8b8ddd3e10890ef79617e6ca3e68552f283134e 199088 openssh-gssapi_10.5p1-1.debian.tar.xz 18c1c6c0e8c59366764993968b07abd5ded8f174878d0ce2f7dfeac3c5da9cbe 5350264 openssh-gssapi_10.5p1-1.git.tar.xz 1b885caa9800726744b5adfc2b287540d4171b1c185995a11be2029fce268647 17702 openssh-gssapi_10.5p1-1_source.buildinfo Files: 8353133366f75ab1dbbb2a3d7c9fc305 2971 net optional openssh-gssapi_10.5p1-1.dsc 480e772a34d02b9e05f39b25903f7618 1632904 net optional openssh-gssapi_10.5p1.orig.tar.xz ee14bc165325fc544cce46e18c44f065 199088 net optional openssh-gssapi_10.5p1-1.debian.tar.xz f189fdde97eb1196133060581ff589e2 5350264 net optional openssh-gssapi_10.5p1-1.git.tar.xz c8f9b92a6d0f60ec713f8c6cfb0d2cb9 17702 net optional openssh-gssapi_10.5p1-1_source.buildinfo Git-Tag-Info: tag=31ef789f6e1f84a037865d49f7bc9173e88037db fp=ac0a4ff12611b6fccf01c111393587d97d86500b Git-Tag-Tagger: Colin Watson <cjwatson@debian.org> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqWBKUACgkQYG0ITkaD wHlcwxAAuFhhOB8mNpjqbL96CXXd2eCN39ugKK5+JLl5PXk9ycBo3KJGVqXhqjEN dQpXb7rEilqQXDEABp4W4Q93O/C2Z3imQoKegaAytTnYemzUPzIDkq9oLC9gTN0+ gQ1ckGAFCnBVRybkeAXtmQx6yxDaY1tZ4yUQIzIMr4Tl/4WNniRYiMEvLZokqZYh kPSVL2Wj5GTnQNEfvNN4hz6mbvktDCSrIqQcwPm0CCJDOR1HckUtJYb9GjeByAmn G38Wm7gY8NKPDZC0iy7HfdEX+/SORpWtbjjgmnbn1cZjCgAtObwMeMBkl3w34qnP BYMSCzwzg5d9L/HxSv4TrGrSZfuEbjFBaA6MxPtgLiIpuLGdqhtjPvioXVMJwS2o R09lmioxNEBDOrFYVqcx4uhjyo/xjtIcLHRIKRZmMT2O2WTdz6W0tC8ECBTpaufn Z7Gb4iNoTiHWMtCNlgxSBp6fbGNRSkPQdlkrbN9YyotTLXcX5/ggzIVSExajpG/Y jptd+DVbGYHGUp7nGhkRI+mZWKX1WCT1XXxVaFEdZcq2H5o6TeFDdbXZh32zrCGd fC6S8+R3PwigwkQErXU+8igVeRBJTYG024eZ36bB7rSyu/zG763uinmKARmzEupz H4lNMGb7LNkaJfNR0OO8SrZr9c9PbUZdcRAaEqisd0oPPibhrho= =a/HO -----END PGP SIGNATURE-----
