openssh-gssapi - Debian Package Tracker

general

source: openssh-gssapi (main)
version: 1:10.6p1-1
maintainer: Debian OpenSSH Maintainers (archive) (DMD)
uploaders: Colin Watson [DMD] – Matthew Vernon [DMD]
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

testing: 1:10.5p1-1
unstable: 1:10.6p1-1

versioned links

1:10.5p1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:10.6p1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

openssh-client-gssapi (8 bugs: 0, 6, 2, 0)
openssh-server-gssapi (7 bugs: 0, 4, 3, 0)

action needed

Marked for autoremoval on 21 October: #1148624 high

Version 1:10.5p1-1 of openssh-gssapi is marked for autoremoval from testing on Wed 21 Oct 2026. It is affected by #1148624. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-10-06 Last update: 2026-10-11 07:32

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-55654: A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

Created: 2026-08-24 Last update: 2026-10-08 11:30

9 security issues in forky high

There are 9 open security issues in forky.

9 important issues:

CVE-2026-55654: A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.
CVE-2026-106552: In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
CVE-2026-106553: In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.
CVE-2026-106555: In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.
CVE-2026-106582: In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.
CVE-2026-106583: In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
CVE-2026-106585: In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
CVE-2026-106586: In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.
CVE-2026-106587: In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.

Created: 2026-08-28 Last update: 2026-10-08 11:30

debian/patches: 1 patch with invalid metadata, 7 patches to forward upstream high

Among the 23 debian patches available in version 1:10.6p1-1 of the package, we noticed the following issues:

1 patch with invalid metadata that ought to be fixed.
7 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2026-08-23 Last update: 2026-10-07 09:19

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2026-09-02 Last update: 2026-10-11 07:31

Depends on packages which need a new maintainer normal

The packages that openssh-gssapi depends on which need a new maintainer are:

ssh-askpass (#993155)
- Suggests: ssh-askpass ssh-askpass

Created: 2026-08-23 Last update: 2026-10-11 06:30

4 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 2c957ff4995fbc8e7ab1234230d7abd65160996b
Author: Colin Watson <cjwatson@debian.org>
Date:   Fri Sep 18 10:59:24 2026 +0100

    /etc/init.d/ssh (force-)reload: Ensure that /run/sshd exists
    
    Thanks: Mark Robillard Jr
    Closes: #1148188

commit 6364efb1207889f3ae98055fd3d4b84aa54b11ff
Author: Colin Watson <cjwatson@debian.org>
Date:   Wed Oct 7 12:06:06 2026 +0100

    debian/tests/xinetd: Make failure logs more useful
    
    We stop ssh.service for this test, so its logs aren't especially useful.
    Show logs from xinetd.service instead.

commit e5d3de643ee90cf9022e86a5b80aecb0972d95f3
Author: Colin Watson <cjwatson@debian.org>
Date:   Wed Oct 7 12:03:46 2026 +0100

    Update debian/copyright for 10.6p1

commit 1c0605f680a57988a5f35fb207818901ff377fcb
Author: Colin Watson <cjwatson@debian.org>
Date:   Wed Oct 7 11:17:25 2026 +0100

    Fix typo for PubkeyAuthOptions in 10.6 changelog

Created: 2026-10-07 Last update: 2026-10-09 13:33

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2026-09-01 Last update: 2026-09-01 12:01

testing migrations

This package is part of the ongoing testing transition known as auto-upperlimit-openssh-common. Please avoid uploads unrelated to this transition, they would likely delay it and require supplementary work from the release managers. On the other hand, if your package has problems preventing it to migrate to testing, please fix them as soon as possible. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migrates after: openssh
- Migration status for openssh-gssapi (1:10.5p1-1 to 1:10.6p1-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Autopkgtest for ansible/14.0.0+dfsg-1: amd64: Pass, arm64: Regression ♻ (reference ♻), armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for ansible-core/2.22.0~beta2-1: amd64: Failed (not a regression) ♻ (reference ♻), arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered (failure will be ignored), s390x: Pass
- ∙ ∙ Autopkgtest for openssh-gssapi/1:10.6p1-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for snapd/2.76.3-2: amd64: Pass, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻, i386: No tests, superficial or marked flaky ♻, ppc64el: No tests, superficial or marked flaky ♻, riscv64: Test triggered (failure will be ignored), s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Too young, only 4 of 5 days old
- ∙ ∙ Depends: openssh-gssapi openssh (not considered)
- Additional info (not blocking):
- ∙ ∙ Updating openssh-gssapi will fix bugs in testing: #1148624
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/o/openssh-gssapi.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- Not considered

news

[rss feed]

[2026-10-06] Accepted openssh-gssapi 1:10.6p1-1 (source) into unstable (Colin Watson)
[2026-09-14] openssh-gssapi 1:10.5p1-1 MIGRATED to testing (Debian testing watch)
[2026-08-31] Accepted openssh-gssapi 1:10.5p1-1 (source) into unstable (Colin Watson)
[2026-08-29] openssh-gssapi 1:10.4p1-5 MIGRATED to testing (Debian testing watch)
[2026-08-22] Accepted openssh-gssapi 1:10.4p1-5 (amd64 source) into unstable (Debian FTP Masters) (signed by: Colin Watson)

bugs [bug history graph]

all: 17
RC: 0
I&N: 11
M&W: 6
F&P: 0
patch: 3

links

homepage
lintian (0, 1)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (100, -)
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1:10.5p1-1ubuntu2
2 bugs
patches for 1:10.5p1-1ubuntu2