openssh-gssapi - Debian Package Tracker

general

source: openssh-gssapi (main)
version: 1:10.6p1-1
maintainer: Debian OpenSSH Maintainers (archive) (DMD)
uploaders: Colin Watson [DMD] – Matthew Vernon [DMD]
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

testing: 1:10.6p1-1
unstable: 1:10.6p1-1

versioned links

1:10.6p1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

openssh-client-gssapi (8 bugs: 0, 6, 2, 0)
openssh-server-gssapi (7 bugs: 0, 4, 3, 0)

action needed

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-55654: A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

Created: 2026-08-24 Last update: 2026-10-12 19:00

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-55654: A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

Created: 2026-08-28 Last update: 2026-10-12 19:00

debian/patches: 1 patch with invalid metadata, 7 patches to forward upstream high

Among the 23 debian patches available in version 1:10.6p1-1 of the package, we noticed the following issues:

1 patch with invalid metadata that ought to be fixed.
7 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2026-08-23 Last update: 2026-10-07 09:19

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2026-09-02 Last update: 2026-10-12 22:30

Depends on packages which need a new maintainer normal

The packages that openssh-gssapi depends on which need a new maintainer are:

ssh-askpass (#993155)
- Suggests: ssh-askpass ssh-askpass

Created: 2026-08-23 Last update: 2026-10-12 20:30

12 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 91cdec0964f6646566f570ef976ee364c4fec4cd
Merge: 333893c 1e277d9
Author: Colin Watson <cjwatson@debian.org>
Date:   Sun Oct 11 14:50:43 2026 +0000

    Merge branch 'salsa-openssh-gssapi-purge-test' into 'master'
    
    d/t/purge-keeps-config-with-counterpart: test for purge
    
    See merge request ssh-team/openssh-gssapi!1

commit 1e277d91e223904669c3d59aaa386713cfe82b69
Author: Colin Watson <cjwatson@debian.org>
Date:   Sun Oct 11 15:13:04 2026 +0100

    Add isolation-container restriction
    
    While we might be able to get away without this in some cases,
    installing openssh-server/openssh-server-gssapi may involve starting
    services, so let's not push it.

commit fdfeca1c5c87550841eca5dc85090688654f0f46
Author: Colin Watson <cjwatson@debian.org>
Date:   Sun Oct 11 15:12:28 2026 +0100

    debputy reformat

commit aa181d1e332236f90177cc2674330c495fce232d
Author: Andreas Hasenack <andreas.hasenack@canonical.com>
Date:   Thu Oct 8 20:26:19 2026 -0300

    d/t/purge-keeps-config-with-counterpart: test for purge
    
    Test to validate that switching to the openssh counterparts and then
    purging the removed packages keeps the configuration intact.

commit 333893ca984f3e2928860d0d9522ffcf124bc5ef
Author: Colin Watson <cjwatson@debian.org>
Date:   Sun Oct 11 14:39:51 2026 +0100

    Make xinetd autopkgtest listen on port 2222, not 22
    
    This may make it less likely to fail in CI.

commit bcebcbf28fed7e3512887143e742895ec6f4d1a2
Author: Colin Watson <cjwatson@debian.org>
Date:   Sun Oct 11 14:13:08 2026 +0100

    Fix xinetd autopkgtest dependencies
    
    Gbp-Dch: Ignore

commit 28bd239b66dccafd1e05fbd29935b3457d8b5f1c
Author: Colin Watson <cjwatson@debian.org>
Date:   Sun Oct 11 13:48:59 2026 +0100

    Try harder to restart xinetd in autopkgtest
    
    Just reloading it sometimes mysteriously fails in CI with "Job for
    xinetd.service canceled."  Do a full restart instead, and wait for it to
    come back up.

commit bf305dbc860a053767ed1e322886f23b7ef6051d
Author: Colin Watson <cjwatson@debian.org>
Date:   Sun Oct 11 09:57:47 2026 +0100

    Run regress and non-regress autopkgtests in parallel
    
    The `regress` test takes much longer than the others, so these can
    usefully be parallelized.

commit 2c957ff4995fbc8e7ab1234230d7abd65160996b
Author: Colin Watson <cjwatson@debian.org>
Date:   Fri Sep 18 10:59:24 2026 +0100

    /etc/init.d/ssh (force-)reload: Ensure that /run/sshd exists
    
    Thanks: Mark Robillard Jr
    Closes: #1148188

commit 6364efb1207889f3ae98055fd3d4b84aa54b11ff
Author: Colin Watson <cjwatson@debian.org>
Date:   Wed Oct 7 12:06:06 2026 +0100

    debian/tests/xinetd: Make failure logs more useful
    
    We stop ssh.service for this test, so its logs aren't especially useful.
    Show logs from xinetd.service instead.

commit e5d3de643ee90cf9022e86a5b80aecb0972d95f3
Author: Colin Watson <cjwatson@debian.org>
Date:   Wed Oct 7 12:03:46 2026 +0100

    Update debian/copyright for 10.6p1

commit 1c0605f680a57988a5f35fb207818901ff377fcb
Author: Colin Watson <cjwatson@debian.org>
Date:   Wed Oct 7 11:17:25 2026 +0100

    Fix typo for PubkeyAuthOptions in 10.6 changelog

Created: 2026-10-07 Last update: 2026-10-11 16:49

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2026-09-01 Last update: 2026-09-01 12:01

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-10-06] Accepted openssh-gssapi 1:10.6p1-1 (source) into unstable (Colin Watson)
[2026-09-14] openssh-gssapi 1:10.5p1-1 MIGRATED to testing (Debian testing watch)
[2026-08-31] Accepted openssh-gssapi 1:10.5p1-1 (source) into unstable (Colin Watson)
[2026-08-29] openssh-gssapi 1:10.4p1-5 MIGRATED to testing (Debian testing watch)
[2026-08-22] Accepted openssh-gssapi 1:10.4p1-5 (amd64 source) into unstable (Debian FTP Masters) (signed by: Colin Watson)

bugs [bug history graph]

all: 17
RC: 0
I&N: 11
M&W: 6
F&P: 0
patch: 3

links

homepage
lintian (0, 1)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (100, -)
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1:10.5p1-1ubuntu3
2 bugs
patches for 1:10.5p1-1ubuntu2