Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package openssh for openSUSE:Factory checked in at 2026-08-12 16:10:35 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/openssh (Old) and /work/SRC/openSUSE:Factory/.openssh.new.17972 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openssh" Wed Aug 12 16:10:35 2026 rev:208 rq:1370662 version:10.5p1 Changes: -------- +++ only whitespace diff in changes, re-diffing --- /work/SRC/openSUSE:Factory/openssh/openssh.changes 2026-07-26 11:29:45.617354734 +0200 +++ /work/SRC/openSUSE:Factory/.openssh.new.17972/openssh.changes 2026-08-12 16:11:02.090748304 +0200 @@ -1,0 +2,87 @@ +Tue Aug 11 08:19:07 UTC 2026 - Antonio Larrosa <[email protected]> + +- Update to openssh 10.5p1: + = Potentially-incompatible changes + * Portable OpenSSH now requires ECC (Elliptic Curve + Cryptography) support in libcrypto, including support for the + NISTP521 curve. ECC is included in the default build + configurations of all versions of all libcrypto + implementations currently supported by OpenSSH, including + LibreSSL, OpenSSL, BoringSSL and AWS LC. The --without-openssl + build configuration is not affected. + + = Security + * ssh-agent(1): fix an interaction between agent locking and the + [email protected] extension that is used to identify + forwarded agents. These binding requests were refused when the + agent was locked, with the result that operations that were + intended to be limited to local use only could be performed + remotely, including the ability to add PKCS#11 tokens and make + use of keys that had destination restrictions applied. + Reported by sn0x-sharma + * ssh(1): avoid potential realloc use-after-free in the client if + a remote forwarding is added via the local session multiplexing + socket while a remote forwarding open request is pending with + the server. Report and fix from Brian Mingus of Cognatory + * sshd(8): make the authorized_keys "restrict" keyword apply + correctly to tunnel forwarding too (which is administratively + disabled by default). Reported by Erichen, Institute of + Computing Technology, Chinese Academy of Sciences + + = New features + * ssh-keygen(1): add ability to set or clear the touch-required + and verify-required flags on FIDO private keys when resetting a + private key's passphrase. + * ssh(1): tweak ordering of certificates tried during pubkey + authentication to prefer FIDO keys that do not require user + presence (touch) first, and FIDO keys that require user + verification via PIN or biometrics last. This effectively tries + low-friction authenticators before higher friction ones. + * ssh(1): add a "ssh -Z user@host" mode that prints the keys that + will be tried for public key authentication in the order that + they will be used. + * sshd(8) use setproctitle(3) to identify sshd-session when its + acting as a post-authentication monitor. + + = Bugfixes + * ssh-keyscan(1): make reading the server banner a non-blocking + operation to prevent a stuck server from blocking a many-host + keyscan from proceeding. + * sshd(8): use sshpkt_fatal() instead of plain fatal() for errors + in the packet code as this provides context of the failing peer + (address, port, user, etc). + * sshd(8): when signing hostkey proofs for a client + UpdateHostKeys request, allow each hostkey to perform at most + one signature operation. + * sshd(8) fix GSSAPI option names, that were broken during a + servconf.c refactoring in openssh-10.4; bz3974. + * ssh-keygen(1): pass back errors from ed25519 key generation, + which theoretically can fail. GHPR702. + * sshd(8): move check of public key type against allowed + algorithms to before parsing of the key sent by the peer. This + removes at least some key parsing and verification paths from + the pre-auth attack surface. Suggested by Christopher Paul + Rohlf of Anthropic. + * ssh-keygen(1): fix double frees (impossible to reach outside of + a test harness), and also use freezero where possible. From + Christopher Paul Rohlf at Anthropic. + * sshd(8): fix ChannelTimeout and RekeyLimit not being applied in + sshd_config Match blocks. + * sshd(8): in sshd config dump mode, write all directives in + mixed case for consistency + + = Portability + * sshd(8): re-allow PAMServiceName inside a Match block, which + was incorrectly disabled during a refactoring in openssh-10.4. + bz3987 + +- Drop patch which is already included upstream: + * 0001-Fix-GSSAPI-server-option-names.diff +- Rebase patches: + * openssh-7.7p1-fips.patch + * openssh-7.7p1-pam_check_locks.patch + * openssh-8.0p1-gssapi-keyex.patch + * openssh-8.1p1-audit.patch + * openssh-9.6p1-crypto-policies-man.patch + +------------------------------------------------------------------- Old: ---- 0001-Fix-GSSAPI-server-option-names.diff openssh-10.4p1.tar.gz openssh-10.4p1.tar.gz.asc New: ---- openssh-10.5p1.tar.gz openssh-10.5p1.tar.gz.asc ----------(Old B)---------- Old:/work/SRC/openSUSE:Factory/.openssh.new.17972/openssh.changes-- Drop patch which is already included upstream: /work/SRC/openSUSE:Factory/.openssh.new.17972/openssh.changes: * 0001-Fix-GSSAPI-server-option-names.diff /work/SRC/openSUSE:Factory/.openssh.new.17972/openssh.changes-- Rebase patches: ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openssh-askpass-gnome.spec ++++++ --- /var/tmp/diff_new_pack.XVDmNO/_old 2026-08-12 16:11:04.074831164 +0200 +++ /var/tmp/diff_new_pack.XVDmNO/_new 2026-08-12 16:11:04.078831332 +0200 @@ -18,8 +18,8 @@ %define _name openssh Name: openssh-askpass-gnome -Version: 10.4p1 -%define wrongly_named_version 10.4p1 +Version: 10.5p1 +%define wrongly_named_version 10.5p1 Release: 0 Summary: A GNOME-Based Passphrase Dialog for OpenSSH License: BSD-2-Clause ++++++ openssh.spec ++++++ --- /var/tmp/diff_new_pack.XVDmNO/_old 2026-08-12 16:11:04.130833503 +0200 +++ /var/tmp/diff_new_pack.XVDmNO/_new 2026-08-12 16:11:04.130833503 +0200 @@ -59,7 +59,7 @@ %define _fillupdir %{_localstatedir}/adm/fillup-templates %endif Name: openssh -Version: 10.4p1 +Version: 10.5p1 Release: 0 Summary: Secure Shell Client and Server (Remote Login Program) License: BSD-2-Clause AND MIT @@ -83,8 +83,6 @@ Source15: sshd-sle.pamd Source16: [email protected] Source17: sshd.socket -# PATCH-FIX-UPSTREAM 0001-Fix-GSSAPI-server-option-names.diff https://bugzilla.mindrot.org/show_bug.cgi?id=3974 -Patch0: 0001-Fix-GSSAPI-server-option-names.diff # PATCH-FEATURE-SUSE openssh-7.7p1-X11_trusted_forwarding.patch bsc#50836 -- Enable trusted X11 forwarding by default Patch1: openssh-7.7p1-X11_trusted_forwarding.patch # PATCH-FEATURE-SUSE openssh-7.7p1-enable_PAM_by_default.patch bsc#46749 -- UsePAM yes in default sshd_config ++++++ openssh-10.4p1.tar.gz -> openssh-10.5p1.tar.gz ++++++ ++++ 7224 lines of diff (skipped) ++++++ openssh-7.7p1-fips.patch ++++++ --- /var/tmp/diff_new_pack.XVDmNO/_old 2026-08-12 16:11:05.038871425 +0200 +++ /var/tmp/diff_new_pack.XVDmNO/_new 2026-08-12 16:11:05.046871759 +0200 @@ -967,7 +967,7 @@ + struct Key_types key_types_all[] = { #ifdef WITH_OPENSSL { "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE }, - #ifdef OPENSSL_HAS_ECC + { "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE }, @@ -1018,6 +1022,17 @@ do_gen_all_hostkeys(struct passwd *pw) { NULL, NULL, NULL } }; ++++++ openssh-7.7p1-pam_check_locks.patch ++++++ --- /var/tmp/diff_new_pack.XVDmNO/_old 2026-08-12 16:11:05.090873597 +0200 +++ /var/tmp/diff_new_pack.XVDmNO/_new 2026-08-12 16:11:05.098873931 +0200 @@ -26,14 +26,14 @@ #ifdef USE_PAM #define SSHD_CONFIG_ENTRIES_PAM \ SSHCONF_INTFLAG(use_pam, UsePAM, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) \ --SSHCONF_STRING(pam_service_name, PAMServiceName, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) -+SSHCONF_STRING(pam_service_name, PAMServiceName, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ +-SSHCONF_STRING(pam_service_name, PAMServiceName, SSHCFG_ALL, SSHCFG_COPY_NONE) ++SSHCONF_STRING(pam_service_name, PAMServiceName, SSHCFG_ALL, SSHCFG_COPY_NONE) \ +SSHCONF_INTFLAG(use_pam_check_locks, UsePAMChecklocks, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) #else #define SSHD_CONFIG_ENTRIES_PAM \ SSHCONF_UNSUPPORTED_INT(use_pam, UsePAM, SSHCFG_GLOBAL) \ --SSHCONF_UNSUPPORTED_STRING(pam_service_name, PAMServiceName, SSHCFG_GLOBAL) -+SSHCONF_UNSUPPORTED_STRING(pam_service_name, PAMServiceName, SSHCFG_GLOBAL) \ +-SSHCONF_UNSUPPORTED_STRING(pam_service_name, PAMServiceName, SSHCFG_ALL) ++SSHCONF_UNSUPPORTED_STRING(pam_service_name, PAMServiceName, SSHCFG_ALL) \ +SSHCONF_UNSUPPORTED_STRING(use_pam_check_locks, UsePAMChecklocks, SSHCFG_GLOBAL) #endif ++++++ openssh-8.0p1-gssapi-keyex.patch ++++++ --- /var/tmp/diff_new_pack.XVDmNO/_old 2026-08-12 16:11:05.166876771 +0200 +++ /var/tmp/diff_new_pack.XVDmNO/_new 2026-08-12 16:11:05.174877105 +0200 @@ -4,7 +4,7 @@ +++ openssh-10.3p1/Makefile.in @@ -110,6 +110,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \ kex.o kex-names.o kexdh.o kexgex.o kexecdh.o kexc25519.o \ - kexgexc.o kexgexs.o \ + kexgexc.o kexgexs.o kexmlkem768ecdh.o \ kexsntrup761x25519.o kexmlkem768x25519.o sntrup761.o kexgen.o \ + kexgssc.o \ sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \ @@ -1317,9 +1317,9 @@ --- openssh-10.3p1.orig/kex.h +++ openssh-10.3p1/kex.h @@ -103,6 +103,15 @@ enum kex_exchange { - KEX_C25519_SHA256, KEX_KEM_SNTRUP761X25519_SHA512, KEX_KEM_MLKEM768X25519_SHA256, + KEX_KEM_MLKEM768ECDH_SHA256, +#ifdef GSSAPI + KEX_GSS_GRP1_SHA1, + KEX_GSS_GRP14_SHA1, @@ -2599,9 +2599,9 @@ if (auth_opts->permit_pty_flag) { monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1); @@ -1891,6 +1915,17 @@ monitor_apply_keystate(struct ssh *ssh, - # ifdef OPENSSL_HAS_ECC + kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; kex->kex[KEX_ECDH_SHA2] = kex_gen_server; - # endif + kex->kex[KEX_KEM_MLKEM768ECDH_SHA256] = kex_gen_server; +# ifdef GSSAPI + if (options.gss_keyex) { + kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server; @@ -2613,7 +2613,7 @@ + kex->kex[KEX_GSS_C25519_SHA256] = kexgss_server; + } +# endif - #endif /* WITH_OPENSSL */ + #endif kex->kex[KEX_C25519_SHA256] = kex_gen_server; kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; @@ -1989,8 +2024,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, @@ -3278,20 +3278,6 @@ =================================================================== --- openssh-10.3p1.orig/ssh.1 +++ openssh-10.3p1/ssh.1 -@@ -543,7 +543,13 @@ For full details of the options listed b - .It ForwardX11Timeout - .It ForwardX11Trusted - .It GSSAPIAuthentication -+.It GSSAPIKeyExchange -+.It GSSAPIClientIdentity - .It GSSAPIDelegateCredentials -+.It GSSAPIKexAlgorithms -+.It GSSAPIRenewalForcesRekey -+.It GSSAPIServerIdentity -+.It GSSAPITrustDns - .It GatewayPorts - .It GlobalKnownHostsFile - .It HashKnownHosts @@ -640,6 +646,8 @@ flag), (supported message integrity codes), .Ar kex @@ -3471,10 +3457,10 @@ free(hkalgs); /* start key exchange */ -@@ -272,15 +313,45 @@ ssh_kex2(struct ssh *ssh, char *host, st - # ifdef OPENSSL_HAS_ECC +@@ -272,16 +313,46 @@ ssh_kex2(struct ssh *ssh, char *host, st + ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_client; + ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client; ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client; - # endif -#endif +# ifdef GSSAPI + if (options.gss_keyex) { @@ -3491,6 +3477,7 @@ ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client; ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client; ssh->kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_client; + ssh->kex->kex[KEX_KEM_MLKEM768ECDH_SHA256] = kex_gen_client; ssh->kex->verify_host_key=&verify_host_key_callback; +#if defined(GSSAPI) && defined(WITH_OPENSSL) @@ -3728,9 +3715,9 @@ if ((r = kex_setup(ssh, myproposal)) != 0) fatal_r(r, "kex_setup"); @@ -836,6 +878,17 @@ do_ssh2_kex(struct ssh *ssh) - # ifdef OPENSSL_HAS_ECC + kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; kex->kex[KEX_ECDH_SHA2] = kex_gen_server; - # endif /* OPENSSL_HAS_ECC */ + kex->kex[KEX_KEM_MLKEM768ECDH_SHA256] = kex_gen_server; +# ifdef GSSAPI + if (options.gss_keyex) { + kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server; @@ -3742,7 +3729,7 @@ + kex->kex[KEX_GSS_C25519_SHA256] = kexgss_server; + } +# endif - #endif /* WITH_OPENSSL */ + #endif kex->kex[KEX_C25519_SHA256] = kex_gen_server; kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; Index: openssh-10.3p1/sshd_config ++++++ openssh-8.1p1-audit.patch ++++++ --- /var/tmp/diff_new_pack.XVDmNO/_old 2026-08-12 16:11:05.202878275 +0200 +++ /var/tmp/diff_new_pack.XVDmNO/_new 2026-08-12 16:11:05.210878609 +0200 @@ -1828,8 +1828,8 @@ --- openssh-10.3p1.orig/packet.h +++ openssh-10.3p1/packet.h @@ -226,4 +226,5 @@ char *connection_info_message(struct ssh - # undef EC_POINT - #endif + const u_char *sshpkt_ptr(struct ssh *, size_t *lenp); + char *connection_info_message(struct ssh *ssh); +void packet_destroy_all(struct ssh *, int, int); #endif /* PACKET_H */ ++++++ openssh-9.6p1-crypto-policies-man.patch ++++++ --- /var/tmp/diff_new_pack.XVDmNO/_old 2026-08-12 16:11:05.258880614 +0200 +++ /var/tmp/diff_new_pack.XVDmNO/_new 2026-08-12 16:11:05.262880780 +0200 @@ -2,7 +2,7 @@ =================================================================== --- openssh-10.3p1.orig/ssh_config.5 +++ openssh-10.3p1/ssh_config.5 -@@ -441,17 +441,14 @@ A single argument of +@@ -441,18 +441,14 @@ A single argument of causes no CNAMEs to be considered for canonicalization. This is the default behaviour. .It Cm CASignatureAlgorithms @@ -20,7 +20,8 @@ -ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, [email protected], [email protected], --rsa-sha2-512,rsa-sha2-256 +-rsa-sha2-512,rsa-sha2-256, [email protected] -.Ed -.Pp If the specified list begins with a @@ -96,7 +97,7 @@ .It Cm HashKnownHosts Indicates that .Xr ssh 1 -@@ -1061,38 +1061,26 @@ will not be converted automatically, +@@ -1061,40 +1061,26 @@ will not be converted automatically, but may be manually hashed using .Xr ssh-keygen 1 . .It Cm HostbasedAcceptedAlgorithms @@ -133,12 +134,14 @@ [email protected], [email protected], [email protected], [email protected], -ssh-ed25519, -ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, [email protected], [email protected], [email protected], --rsa-sha2-512,rsa-sha2-256 +-rsa-sha2-512,rsa-sha2-256, [email protected] -.Ed +at the head of the built-in openssh default set. .Pp @@ -256,7 +259,7 @@ The list of available MAC algorithms may also be obtained using .Qq ssh -Q mac . .It Cm NoHostAuthenticationForLocalhost -@@ -1732,41 +1722,32 @@ instead of continuing to execute and pas +@@ -1732,43 +1722,32 @@ instead of continuing to execute and pas The default is .Cm no . .It Cm PubkeyAcceptedAlgorithms @@ -294,12 +297,14 @@ [email protected], [email protected], [email protected], [email protected], -ssh-ed25519, -ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, [email protected], [email protected], [email protected], --rsa-sha2-512,rsa-sha2-256 +-rsa-sha2-512,rsa-sha2-256, [email protected] -.Ed +built-in openssh default set. .Pp @@ -326,7 +331,7 @@ =================================================================== --- openssh-10.3p1.orig/sshd_config.5 +++ openssh-10.3p1/sshd_config.5 -@@ -385,17 +385,14 @@ If the argument is +@@ -385,18 +385,14 @@ If the argument is then no banner is displayed. By default, no banner is displayed. .It Cm CASignatureAlgorithms @@ -344,7 +349,8 @@ -ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, [email protected], [email protected], --rsa-sha2-512,rsa-sha2-256 +-rsa-sha2-512,rsa-sha2-256, [email protected] -.Ed -.Pp If the specified list begins with a @@ -395,7 +401,7 @@ The list of available ciphers may also be obtained using .Qq ssh -Q cipher . .It Cm ClientAliveCountMax -@@ -788,55 +784,45 @@ For this to work +@@ -788,57 +784,45 @@ For this to work .Cm GSSAPIKeyExchange needs to be enabled in the server and also used by the client. .It Cm GSSAPIKexAlgorithms @@ -461,18 +467,20 @@ [email protected], [email protected], [email protected], [email protected], -ssh-ed25519, -ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, [email protected], [email protected], [email protected], --rsa-sha2-512,rsa-sha2-256 +-rsa-sha2-512,rsa-sha2-256, [email protected] -.Ed +the head of the built-in openssh default set. .Pp The list of available signature algorithms may also be obtained using .Qq ssh -Q HostbasedAcceptedAlgorithms . -@@ -903,27 +889,15 @@ is specified, the location of the socket +@@ -903,29 +889,15 @@ is specified, the location of the socket .Ev SSH_AUTH_SOCK environment variable. .It Cm HostKeyAlgorithms @@ -495,12 +503,14 @@ [email protected], [email protected], [email protected], [email protected], -ssh-ed25519, -ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, [email protected], [email protected], [email protected], --rsa-sha2-512,rsa-sha2-256 +-rsa-sha2-512,rsa-sha2-256, [email protected] -.Ed -.Pp The list of available signature algorithms may also be obtained using @@ -603,7 +613,7 @@ The list of available MAC algorithms may also be obtained using .Qq ssh -Q mac . .It Cm Match -@@ -1765,38 +1734,26 @@ or equivalent.) +@@ -1765,40 +1734,26 @@ or equivalent.) The default is .Cm yes . .It Cm PubkeyAcceptedAlgorithms @@ -641,12 +651,14 @@ [email protected], [email protected], [email protected], [email protected], -ssh-ed25519, -ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, [email protected], [email protected], [email protected], --rsa-sha2-512,rsa-sha2-256 +-rsa-sha2-512,rsa-sha2-256, [email protected] -.Ed +built-in openssh default set. .Pp
