openssh-gssapi - Debian Package Tracker

general

source: openssh-gssapi (main)
version: 1:10.4p1-5
maintainer: Debian OpenSSH Maintainers (archive) (DMD)
uploaders: Colin Watson [DMD] – Matthew Vernon [DMD]
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

unstable: 1:10.4p1-5

versioned links

1:10.4p1-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

openssh-client-gssapi (8 bugs: 0, 6, 2, 0)
openssh-server-gssapi (7 bugs: 0, 4, 3, 0)

action needed

A new upstream version is available: 10.5p1 high

A new upstream version 10.5p1 is available, you should consider packaging it.

Created: 2026-08-23 Last update: 2026-08-25 05:00

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-55654: A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

Created: 2026-08-24 Last update: 2026-08-24 08:01

debian/patches: 1 patch with invalid metadata, 7 patches to forward upstream high

Among the 24 debian patches available in version 1:10.4p1-5 of the package, we noticed the following issues:

1 patch with invalid metadata that ought to be fixed.
7 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2026-08-23 Last update: 2026-08-23 10:00

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2026-08-23 Last update: 2026-08-25 09:19

Depends on packages which need a new maintainer normal

The packages that openssh-gssapi depends on which need a new maintainer are:

ssh-askpass (#993155)
- Suggests: ssh-askpass ssh-askpass

Created: 2026-08-23 Last update: 2026-08-25 07:00

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status for openssh-gssapi (- to 1:10.4p1-5): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Autopkgtest for ansible/14.0.0+dfsg-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for ansible-core/2.21.2-1: amd64: Pass, arm64: Regression ♻ (reference ♻), armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered (failure will be ignored), s390x: Test triggered
- ∙ ∙ Autopkgtest for ceph/20.2.2+ds-13: amd64: Pass, arm64: Pass, armhf: Failed (not a regression) ♻ (reference ♻), i386: Failed (not a regression) ♻ (reference ♻), loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for fence-agents/4.17.0-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for freedombox/26.10: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for git-annex/10.20251029-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for hipercontracer/2.2.6-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for keychain/2.9.8-3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for lava/2026.07-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for libguestfs/1:1.58.1-8: amd64: Pass, arm64: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for libnet-openssh-perl/0.84-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for libnet-scp-perl/0.08-4: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for libnet-sftp-foreign-perl/1.93+dfsg-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for libnet-ssh-perl/0.09-5: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for libnetapp-perl/500.002-3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for moraine/0.2.2-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for nova/2:33.0.1-5: amd64: Pass, arm64: Pass, armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: No tests, superficial or marked flaky ♻, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for openmpi/5.0.10-1: amd64: Pass, arm64: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for openssh/1:10.4p1-4: armhf: Pass, loong64: Test triggered, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for openssh-gssapi/1:10.4p1-5: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for oz/0.17.0-7: amd64: Pass, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: No tests, superficial or marked flaky ♻, loong64: Test triggered, ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for parallax/1.0.8-3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for patatt/0.8.0-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for piuparts/1.6.0: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered (failure will be ignored), s390x: Test triggered
- ∙ ∙ Autopkgtest for pkg-perl-tools/0.88: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for rancid/3.14-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for reform-tools/1.88-1: amd64: No tests, superficial or marked flaky ♻, arm64: Pass, armhf: No tests, superficial or marked flaky ♻, i386: No tests, superficial or marked flaky ♻, loong64: Test triggered, ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for snapd/2.76-1: amd64: Pass, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: No tests, superficial or marked flaky ♻, ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for ssh-agent-filter/0.5.3-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Autopkgtest for ssh-tools/1.9-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Test triggered, ppc64el: Pass, riscv64: Test triggered, s390x: Test triggered
- ∙ ∙ Too young, only 2 of 5 days old
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/o/openssh-gssapi.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- Not considered

news

[rss feed]

[2026-08-22] Accepted openssh-gssapi 1:10.4p1-5 (amd64 source) into unstable (Debian FTP Masters) (signed by: Colin Watson)

bugs [bug history graph]

all: 16
RC: 0
I&N: 10
M&W: 6
F&P: 0
patch: 3

links

homepage
lintian
buildd: logs, cross
popcon
browse source code
other distros
security tracker
l10n (100, -)
debian patches