Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package openssh for openSUSE:Factory checked in at 2026-11-08 19:21:10 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/openssh (Old) and /work/SRC/openSUSE:Factory/.openssh.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openssh" Sun Nov 8 19:21:10 2026 rev:212 rq:1395690 version:10.6p2 Changes: -------- +++ only whitespace diff in changes, re-diffing --- /work/SRC/openSUSE:Factory/openssh/openssh.changes 2026-10-14 18:34:20.921913707 +0200 +++ /work/SRC/openSUSE:Factory/.openssh.new.3759290/openssh.changes 2026-11-08 19:21:13.797004973 +0100 @@ -1,0 +2,59 @@ +Fri Nov 6 00:04:42 UTC 2026 - Antonio Larrosa <[email protected]> + +- Update to openssh 10.6p2: + This release contains a critical security workaround that affects + Linux systems that use the musl libc and PAM disabled. + This release also includes a number of bugfixes that had already + been committed on the portable OpenSSH V_10_6 stable branch. + + = Future deprecation notice + * scp(1): begin deprecating the -R flag, which is used to perform + a remote-to-remote copy by executing scp on a remote host. This + option is a fragile optimisation that is difficult to use + because it requires credentials on the remote host. It also + creates security risks if the shell quoting rules on the remote + system where the copy is performed differ from the client's + expectations. + + From OpenSSH 10.6, this option will continue to work but will + cause a deprecation warning to be emitted to standard error. In + a future release, the option will be ignored and will leave in + place the default remote-to-remote copy behaviour (copy via the + host running scp). + + * sshd(8): support for platforms that do not allow file + descriptor passing and that also require root privilege for PTY + allocation will be removed in a future release. Affected + platforms are known to include SCO OpenServer 5 and QNX 6 but + may include other similarly old operating systems. This + deprecation can be avoided if the user community for these + platforms is able to assist us in building alternatives, such + as avoiding the need for root in PTY allocation. + + = Security + * sshd(8): avoid password authentication bypass that is + exploitable through sshd(8) that affects some Linux systems + when built and run with PAM support disabled. We consider the + root cause of this bug to be outside sshd, but it is + exploitable via sshd and can be avoided there. + This bug was reported by Özgün Kültekin of Wakefield + (wakefield.co) + + = Bugfixes + * sshd(8), ssh(1): enable the post-quantum hybris signature + scheme ssh-mldsa44-ed25519 as an allowed CA signature + algorithm. + * ssh(1), sshd(8): fix <1 second CPU spin if ChannelTimeout was + in use. + + = Portability + * sshd(8): fix compilation on (old) platforms that set + SKIP_PRIVDROP + * ssh(1), sshd(8): fix detection of Azerbaijani locales + * sshd(8), ssh-agent(1): fix creation of agent sockets on + platforms without the openat(2) syscall. + * ssh(1), ssh-add(1), ssh-keygen(1): fix some strange behaviour + if SIGINT/SIGQUIT was received while reading a passphrase. + * sshd(8): allow restart_syscall(2) in seccomp sandbox; bz4036 + +------------------------------------------------------------------- Old: ---- openssh-10.6p1.tar.gz openssh-10.6p1.tar.gz.asc New: ---- openssh-10.6p2.tar.gz openssh-10.6p2.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openssh-askpass-gnome.spec ++++++ --- /var/tmp/diff_new_pack.zR0JEG/_old 2026-11-08 19:21:15.484074763 +0100 +++ /var/tmp/diff_new_pack.zR0JEG/_new 2026-11-08 19:21:15.486074846 +0100 @@ -18,8 +18,8 @@ %define _name openssh Name: openssh-askpass-gnome -Version: 10.6p1 -%define wrongly_named_version 10.6p1 +Version: 10.6p2 +%define wrongly_named_version 10.6p2 Release: 0 Summary: A GNOME-Based Passphrase Dialog for OpenSSH License: BSD-2-Clause ++++++ openssh.spec ++++++ --- /var/tmp/diff_new_pack.zR0JEG/_old 2026-11-08 19:21:15.537076956 +0100 +++ /var/tmp/diff_new_pack.zR0JEG/_new 2026-11-08 19:21:15.540077080 +0100 @@ -58,7 +58,7 @@ %define _fillupdir %{_localstatedir}/adm/fillup-templates %endif Name: openssh -Version: 10.6p1 +Version: 10.6p2 Release: 0 Summary: Secure Shell Client and Server (Remote Login Program) License: BSD-2-Clause AND MIT ++++++ openssh-10.6p1.tar.gz -> openssh-10.6p2.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/openssh-10.6p1/.depend new/openssh-10.6p2/.depend --- old/openssh-10.6p1/.depend 2026-10-06 10:45:31.000000000 +0200 +++ new/openssh-10.6p2/.depend 2026-11-05 00:57:26.000000000 +0100 @@ -12,7 +12,7 @@ auth-krb5.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h ssh.h packet.h dispatch.h log.h ssherr.h sshbuf.h sshkey.h misc.h servconf.h uidswap.h hostfile.h auth.h auth-pam.h audit.h loginrec.h auth-options.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h ssherr.h log.h sshbuf.h misc.h sshkey.h match.h ssh2.h auth-options.h auth-pam.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h -auth-passwd.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h packet.h dispatch.h sshbuf.h ssherr.h log.h misc.h servconf.h sshkey.h hostfile.h auth.h auth-pam.h audit.h loginrec.h auth-options.h +auth-passwd.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h packet.h dispatch.h sshbuf.h ssherr.h log.h misc.h xmalloc.h servconf.h sshkey.h hostfile.h auth.h auth-pam.h audit.h loginrec.h auth-options.h auth-rhosts.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h packet.h dispatch.h uidswap.h pathnames.h log.h ssherr.h misc.h xmalloc.h sshbuf.h sshkey.h servconf.h canohost.h hostfile.h auth.h auth-pam.h audit.h loginrec.h auth-shadow.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h auth-sia.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/bsd-sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/openssh-10.6p1/.github/workflows/selfhosted.yml new/openssh-10.6p2/.github/workflows/selfhosted.yml --- old/openssh-10.6p1/.github/workflows/selfhosted.yml 2026-10-06 10:45:31.000000000 +0200 +++ new/openssh-10.6p2/.github/workflows/selfhosted.yml 2026-11-05 00:57:26.000000000 +0100 @@ -92,6 +92,8 @@ - { target: nbsd10, config: pam, host: libvirt } - { target: nbsd11, config: pam, host: libvirt } - { target: omnios, config: pam, host: libvirt } + # ARM32 VMs + - { target: debian-arm, config: default, host: libvirt-arm} # ARM64 VMs - { target: obsdsnap-arm64, config: default, host: libvirt-arm64 } # VMs with persistent disks that have their own runner. @@ -101,7 +103,6 @@ - { target: ARM64, config: default, host: ARM64 } - { target: ARM64, config: pam, host: ARM64 } # Physical hosts with remote runners. - - { target: debian-arm, config: default, host: remote-debian-arm} - { target: debian-riscv64, config: default, host: remote-debian-riscv64 } - { target: openwrt-mips, config: default, host: remote-openwrt-mips } - { target: openwrt-mipsel, config: default, host: remote-openwrt-mipsel } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/openssh-10.6p1/.github/workflows/vm.yml new/openssh-10.6p2/.github/workflows/vm.yml --- old/openssh-10.6p1/.github/workflows/vm.yml 2026-10-06 10:45:31.000000000 +0200 +++ new/openssh-10.6p2/.github/workflows/vm.yml 2026-11-05 00:57:26.000000000 +0100 @@ -97,7 +97,7 @@ usesh: true prepare: | case $(uname -r) in - 12.*) + 12.*|13.*) timeout 600 ftp ftp://ftp.sudo.ws/pub/sudo/sudo-1.8.32.tar.gz || \ ftp ftp://ftp.sudo.ws/pub/sudo/sudo-1.8.32.tar.gz tar xfz sudo-1.8.32.tar.gz diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/openssh-10.6p1/auth-passwd.c new/openssh-10.6p2/auth-passwd.c --- old/openssh-10.6p1/auth-passwd.c 2026-10-06 10:45:31.000000000 +0200 +++ new/openssh-10.6p2/auth-passwd.c 2026-11-05 00:57:26.000000000 +0100 @@ -50,6 +50,7 @@ #include "ssherr.h" #include "log.h" #include "misc.h" +#include "xmalloc.h" #include "servconf.h" #include "sshkey.h" #include "hostfile.h" @@ -67,6 +68,7 @@ #define DAY (24L * 60 * 60) /* 1 day in seconds */ #define TWO_WEEKS (2L * 7 * DAY) /* 2 weeks in seconds */ +#define MIN_PASSWORD_HASH_LEN 4 #define MAX_PASSWORD_LEN 1024 /* @@ -194,16 +196,20 @@ Authctxt *authctxt = ssh->authctxt; struct passwd *pw = authctxt->pw; char *encrypted_password, *salt = NULL; + int ret; /* Just use the supplied fake password if authctxt is invalid */ - char *pw_password = authctxt->valid ? shadow_pw(pw) : pw->pw_passwd; + char *pw_password = authctxt->valid ? + shadow_pw(pw) : xstrdup(pw->pw_passwd); if (pw_password == NULL) return 0; /* Check for users with no password. */ - if (strcmp(pw_password, "") == 0 && strcmp(password, "") == 0) - return (1); + if (strcmp(pw_password, "") == 0 && strcmp(password, "") == 0) { + free(pw_password); + return 1; + } /* * Encrypt the candidate password using the proper salt, or pass a @@ -217,7 +223,10 @@ * Authentication is accepted if the encrypted passwords * are identical. */ - return encrypted_password != NULL && + ret = encrypted_password != NULL && + strlen(pw_password) >= MIN_PASSWORD_HASH_LEN && strcmp(encrypted_password, pw_password) == 0; + freezero(pw_password, strlen(pw_password)); + return ret; } #endif diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/openssh-10.6p1/channels.c new/openssh-10.6p2/channels.c --- old/openssh-10.6p1/channels.c 2026-10-06 10:45:31.000000000 +0200 +++ new/openssh-10.6p2/channels.c 2026-11-05 00:57:26.000000000 +0100 @@ -2774,7 +2774,7 @@ if (timeout != NULL && c->type == SSH_CHANNEL_OPEN && channel_get_expiry(ssh, c) != 0) { - ptimeout_deadline_monotime(timeout, + ptimeout_deadline_monotime_double(timeout, channel_get_expiry(ssh, c)); } } else if (timeout != NULL) { @@ -2782,7 +2782,7 @@ * Arrange for poll() wakeup when channel pause * timer expires. */ - ptimeout_deadline_monotime(timeout, + ptimeout_deadline_monotime_double(timeout, c->notbefore); } } @@ -4347,8 +4347,7 @@ #ifdef SKIP_PRIVDROP if (fwd->listen_path != NULL) return 0; - if (allowed_open->listen_port != FWD_PERMIT_ANY_PORT && - allowed_open->listen_port < 1024) + if (fwd->listen_port != 0 && fwd->listen_port < 1024) return 0; #endif diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/openssh-10.6p1/contrib/redhat/openssh.spec new/openssh-10.6p2/contrib/redhat/openssh.spec --- old/openssh-10.6p1/contrib/redhat/openssh.spec 2026-10-06 10:45:31.000000000 +0200 +++ new/openssh-10.6p2/contrib/redhat/openssh.spec 2026-11-05 00:57:26.000000000 +0100 @@ -1,4 +1,4 @@ -%global ver 10.6p1 +%global ver 10.6p2 %global rel 1%{?dist} # OpenSSH privilege separation requires a user & group ID diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/openssh-10.6p1/contrib/suse/openssh.spec new/openssh-10.6p2/contrib/suse/openssh.spec --- old/openssh-10.6p1/contrib/suse/openssh.spec 2026-10-06 10:45:31.000000000 +0200 +++ new/openssh-10.6p2/contrib/suse/openssh.spec 2026-11-05 00:57:26.000000000 +0100 @@ -13,7 +13,7 @@ Summary: OpenSSH, a free Secure Shell (SSH) protocol implementation Name: openssh -Version: 10.6p1 +Version: 10.6p2 URL: https://www.openssh.com/ Release: 1 Source0: openssh-%{version}.tar.gz diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/openssh-10.6p1/misc.c new/openssh-10.6p2/misc.c --- old/openssh-10.6p1/misc.c 2026-10-06 10:45:31.000000000 +0200 +++ new/openssh-10.6p2/misc.c 2026-11-05 00:57:26.000000000 +0100 @@ -3330,7 +3330,9 @@ } /* Work through the path, component-wise */ - while ((p = strsep(&dir, "/")) && p != '\0') { + while ((p = strsep(&dir, "/"))) { + if (*p == '\0') + continue; if (strlcat(path, "/", plen) >= plen || strlcat(path, p, plen) >= plen) goto out; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/openssh-10.6p1/myproposal.h new/openssh-10.6p2/myproposal.h --- old/openssh-10.6p1/myproposal.h 2026-10-06 10:45:31.000000000 +0200 +++ new/openssh-10.6p2/myproposal.h 2026-11-05 00:57:26.000000000 +0100 @@ -1,4 +1,4 @@ -/* $OpenBSD: myproposal.h,v 1.82 2026/09/02 09:04:11 djm Exp $ */ +/* $OpenBSD: myproposal.h,v 1.83 2026/10/07 22:29:49 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. @@ -93,7 +93,8 @@ "[email protected]," \ "[email protected]," \ "rsa-sha2-512," \ - "rsa-sha2-256" \ + "rsa-sha2-256," \ + "ssh-mldsa44-ed25519" #define KEX_DEFAULT_COMP "none,[email protected]" #define KEX_DEFAULT_LANG "" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/openssh-10.6p1/openbsd-compat/port-uw.c new/openssh-10.6p2/openbsd-compat/port-uw.c --- old/openssh-10.6p1/openbsd-compat/port-uw.c 2026-10-06 10:45:31.000000000 +0200 +++ new/openssh-10.6p2/openbsd-compat/port-uw.c 2026-11-05 00:57:26.000000000 +0100 @@ -58,14 +58,17 @@ int result; /* Just use the supplied fake password if authctxt is invalid */ - char *pw_password = authctxt->valid ? shadow_pw(pw) : pw->pw_passwd; + char *pw_password = authctxt->valid ? + shadow_pw(pw) : xstrdup(pw->pw_passwd); if (pw_password == NULL) return 0; /* Check for users with no password. */ - if (strcmp(pw_password, "") == 0 && strcmp(password, "") == 0) - return (1); + if (strcmp(pw_password, "") == 0 && strcmp(password, "") == 0) { + free(pw_password); + return 1; + } /* Encrypt the candidate password using the proper salt. */ salt = (pw_password[0] && pw_password[1]) ? pw_password : "xx"; @@ -83,11 +86,8 @@ #endif /* UNIXWARE_LONG_PASSWORDS */ result = (strcmp(xcrypt(password, salt), pw_password) == 0); -#ifdef USE_LIBIAF - if (authctxt->valid) - free(pw_password); -#endif - return(result); + freezero(pw_password, strlen(pw_password)); + return result; } #ifdef UNIXWARE_LONG_PASSWORDS diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/openssh-10.6p1/openbsd-compat/readpassphrase.c new/openssh-10.6p2/openbsd-compat/readpassphrase.c --- old/openssh-10.6p1/openbsd-compat/readpassphrase.c 2026-10-06 10:45:31.000000000 +0200 +++ new/openssh-10.6p2/openbsd-compat/readpassphrase.c 2026-11-05 00:57:26.000000000 +0100 @@ -1,4 +1,4 @@ -/* $OpenBSD: readpassphrase.c,v 1.30 2026/09/16 01:24:59 djm Exp $ */ +/* $OpenBSD: readpassphrase.c,v 1.31 2026/10/15 05:55:06 djm Exp $ */ /* * Copyright (c) 2000-2002, 2007, 2010 @@ -133,11 +133,11 @@ sigemptyset(&sa.sa_mask); sa.sa_flags = 0; /* don't restart system calls */ sa.sa_handler = handler; + sigaction(SIGINT, &sa, &saveint); + sigaction(SIGQUIT, &sa, &savequit); sigaction_except_ign(SIGALRM, &sa, &savealrm); sigaction_except_ign(SIGHUP, &sa, &savehup); - sigaction_except_ign(SIGINT, &sa, &saveint); sigaction_except_ign(SIGPIPE, &sa, &savepipe); - sigaction_except_ign(SIGQUIT, &sa, &savequit); sigaction_except_ign(SIGTERM, &sa, &saveterm); sigaction_except_ign(SIGTSTP, &sa, &savetstp); sigaction_except_ign(SIGTTIN, &sa, &savettin); @@ -175,10 +175,10 @@ continue; signo[SIGTTOU] = sigttou; } + sigaction(SIGINT, &saveint, NULL); + sigaction(SIGQUIT, &savequit, NULL); sigaction_except_ign(SIGALRM, &savealrm, NULL); sigaction_except_ign(SIGHUP, &savehup, NULL); - sigaction_except_ign(SIGINT, &saveint, NULL); - sigaction_except_ign(SIGQUIT, &savequit, NULL); sigaction_except_ign(SIGPIPE, &savepipe, NULL); sigaction_except_ign(SIGTERM, &saveterm, NULL); sigaction_except_ign(SIGTSTP, &savetstp, NULL); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/openssh-10.6p1/openbsd-compat/xcrypt.c new/openssh-10.6p2/openbsd-compat/xcrypt.c --- old/openssh-10.6p1/openbsd-compat/xcrypt.c 2026-10-06 10:45:31.000000000 +0200 +++ new/openssh-10.6p2/openbsd-compat/xcrypt.c 2026-11-05 00:57:26.000000000 +0100 @@ -25,6 +25,8 @@ #include "includes.h" #include <sys/types.h> +#include <stdarg.h> +#include <stdlib.h> #include <string.h> #include <unistd.h> #include <pwd.h> @@ -59,6 +61,8 @@ # define crypt DES_crypt # endif +#include "xmalloc.h" + #define MINIMUM(a, b) (((a) < (b)) ? (a) : (b)) /* @@ -71,7 +75,7 @@ pick_salt(void) { struct passwd *pw; - char *passwd, *p; + char *passwd = NULL, *p; size_t typelen; static char salt[32]; @@ -80,6 +84,8 @@ strlcpy(salt, "xx", sizeof(salt)); setpwent(); while ((pw = getpwent()) != NULL) { + if (passwd != NULL) + freezero(passwd, strlen(passwd)); if ((passwd = shadow_pw(pw)) == NULL) continue; if (passwd[0] == '$' && (p = strrchr(passwd+1, '$')) != NULL) { @@ -90,6 +96,8 @@ } } out: + if (passwd != NULL) + freezero(passwd, strlen(passwd)); endpwent(); return salt; } @@ -122,9 +130,8 @@ /* * Handle shadowed password systems in a cleaner way for portable - * version. + * version. Caller must free returned value. */ - char * shadow_pw(struct passwd *pw) { @@ -138,7 +145,8 @@ # endif #ifdef USE_LIBIAF - return(get_iaf_password(pw)); + pw_password = get_iaf_password(pw); + return pw_password == NULL ? NULL : xstrdup(pw_password); #endif # if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) @@ -152,5 +160,5 @@ pw_password = spw->ufld.fd_encrypt; # endif - return pw_password; + return pw_password == NULL ? NULL : xstrdup(pw_password); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/openssh-10.6p1/sandbox-seccomp-filter.c new/openssh-10.6p2/sandbox-seccomp-filter.c --- old/openssh-10.6p1/sandbox-seccomp-filter.c 2026-10-06 10:45:31.000000000 +0200 +++ new/openssh-10.6p2/sandbox-seccomp-filter.c 2026-11-05 00:57:26.000000000 +0100 @@ -441,6 +441,9 @@ #ifdef __NR_uname SC_ALLOW(__NR_uname), #endif +#ifdef __NR_restart_syscall + SC_ALLOW(__NR_restart_syscall), +#endif #ifdef __NR_setsockopt SC_ALLOW_SETSOCKOPT(IPPROTO_IPV6, IPV6_TCLASS), SC_ALLOW_SETSOCKOPT(IPPROTO_IP, IP_TOS), diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/openssh-10.6p1/servconf.c new/openssh-10.6p2/servconf.c --- old/openssh-10.6p1/servconf.c 2026-10-06 10:45:31.000000000 +0200 +++ new/openssh-10.6p2/servconf.c 2026-11-05 00:57:26.000000000 +0100 @@ -280,7 +280,7 @@ logit("StreamlocalForwarding is not supported on this system"); options->allow_streamlocal_forwarding = 0; if (options->fwd_opts.gateway_ports != -1 && - options->fwd_opts.gateway_ports == 0) + options->fwd_opts.gateway_ports != 0) logit("GatewayPorts is not supported on this system"); options->fwd_opts.gateway_ports = 0; #endif diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/openssh-10.6p1/utf8.c new/openssh-10.6p2/utf8.c --- old/openssh-10.6p1/utf8.c 2026-10-06 10:45:31.000000000 +0200 +++ new/openssh-10.6p2/utf8.c 2026-11-05 00:57:26.000000000 +0100 @@ -339,7 +339,7 @@ continue; if (strncasecmp(cp, "tr", 2) != 0 && strncasecmp(cp, "crh", 3) != 0 && - strncasecmp(cp, "az", 3) != 0) + strncasecmp(cp, "az", 2) != 0) break; /* * If we're in a UTF-8 locale then prefer to use diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/openssh-10.6p1/version.h new/openssh-10.6p2/version.h --- old/openssh-10.6p1/version.h 2026-10-06 10:45:31.000000000 +0200 +++ new/openssh-10.6p2/version.h 2026-11-05 00:57:26.000000000 +0100 @@ -2,5 +2,5 @@ #define SSH_VERSION "OpenSSH_10.6" -#define SSH_PORTABLE "p1" +#define SSH_PORTABLE "p2" #define SSH_RELEASE SSH_VERSION SSH_PORTABLE
