Your message dated Fri, 27 Mar 2026 18:48:53 +0000
with message-id <[email protected]>
and subject line Bug#989906: fixed in openssh 1:10.2p1-6
has caused the Debian Bug report #989906,
regarding openssh-server: With GSSAPIKeyExchange "yes" openssh presents poor
quality key exchange methods
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
989906: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989906
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: openssh-server
Version: 1:7.9p1-10+deb10u2
Severity: important
Dear Maintainer,
What did I do?
* Configured GSSAPIKeyExchange "yes", because it's a good idea and
the automatic updating of renewed credentials it allows is very,
very useful.
What happened?
* When connecting to the OpenSSH server I see some quite horrible key
exchange methods proposed and accepted:
debug1: Offering GSSAPI proposal:
gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==,gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==,gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g==,gss-gex-sha1-eipGX3TCiQSrx573bT1o1Q==,gss-group1-sha1-eipGX3TCiQSrx573bT1o1Q==,gss-group14-sha1-eipGX3TCiQSrx573bT1o1Q==
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==
* What outcome did you expect instead?
Something more modern?
Some security scanners have started reporting at least
gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g== as a vulnerability, e.g. Qualys calls it
"QID 38739: Deprecated SSH Cryptographic Settings"
https://qualys-secure.force.com/customer/s/article/000006407
As far as I can tell there is no way of configuring openssh to avoid using
gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==.
-- System Information:
Debian Release: 10.9
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 4.19.0-14-amd64 (SMP w/4 CPU cores)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C.UTF-8
(charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages openssh-server depends on:
ii adduser 3.118
ii debconf [debconf-2.0] 1.5.71
ii dpkg 1.19.7
ii libaudit1 1:2.8.4-3
ii libc6 2.28-10
ii libcom-err2 1.44.5-1+deb10u3
ii libgssapi-krb5-2 1.17-3+deb10u1
ii libkrb5-3 1.17-3+deb10u1
ii libpam-modules 1.3.1-5
ii libpam-runtime 1.3.1-5
ii libpam0g 1.3.1-5
ii libselinux1 2.8-1+b1
ii libssl1.1 1.1.1d-0+deb10u6
ii libsystemd0 241-7~deb10u7
ii libwrap0 7.6.q-28
ii lsb-base 10.2019051400
ii openssh-client 1:7.9p1-10+deb10u2
ii openssh-sftp-server 1:7.9p1-10+deb10u2
ii procps 2:3.3.15-2
ii ucf 3.0038+nmu1
ii zlib1g 1:1.2.11.dfsg-1
Versions of packages openssh-server recommends:
ii libpam-systemd [logind] 241-7~deb10u7
ii ncurses-term 6.1+20181013-2+deb10u2
ii xauth 1:1.0.10-1
Versions of packages openssh-server suggests:
pn molly-guard <none>
pn monkeysphere <none>
pn rssh <none>
pn ssh-askpass <none>
pn ufw <none>
-- debconf information excluded
--- End Message ---
--- Begin Message ---
Source: openssh
Source-Version: 1:10.2p1-6
Done: Colin Watson <[email protected]>
We believe that the bug you reported is fixed in the latest version of
openssh, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Colin Watson <[email protected]> (supplier of updated openssh package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 27 Mar 2026 18:26:06 +0000
Source: openssh
Architecture: source
Version: 1:10.2p1-6
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenSSH Maintainers <[email protected]>
Changed-By: Colin Watson <[email protected]>
Closes: 989906 1130595 1131206
Changes:
openssh (1:10.2p1-6) unstable; urgency=medium
.
* CVE-2026-3497: Fix incorrect GSS-API error handling; Replace incorrect
use of sshpkt_disconnect() with ssh_packet_disconnect(), and properly
initialize some variables (closes: #1130595; thanks, Marc Deslauriers).
* Do not default to weak GSS-API exchange algorithms (closes: #989906,
#1131206; LP: #2144812; thanks, Athos Ribeiro).
Checksums-Sha1:
610f94c16831361f03f71aff30ffd36f18f6efc2 3668 openssh_10.2p1-6.dsc
bd029b935a0c2316ef65536d4a53e60f604a9b42 200260 openssh_10.2p1-6.debian.tar.xz
c4ec5f7d24c2aa94ad54d04a18c2477d94a88ea8 49092260 openssh_10.2p1-6.git.tar.xz
fc7c90ae55d9d6620bf57b7446d2d2d48efe97d6 17335
openssh_10.2p1-6_source.buildinfo
Checksums-Sha256:
9626c4ff065fd1f2028fe2a9ad8cedf03960931c83513733e539f2289bc49d21 3668
openssh_10.2p1-6.dsc
c901bfeb0d1d6238e600c5121d7b93e008b867853ce39a0fce8c670000ef6f1b 200260
openssh_10.2p1-6.debian.tar.xz
bfccbf2b94ab99877c4eff8a787f1b85469539fbf07be772504898e8c9a919cc 49092260
openssh_10.2p1-6.git.tar.xz
58277d2b52fae6b3ab67eb0d803a197705a517baea134a5149fceb8810076fec 17335
openssh_10.2p1-6_source.buildinfo
Files:
dd3c13f6f9d5f456511558b72acd58f8 3668 net standard openssh_10.2p1-6.dsc
59e2eda39705bbd4901adf5cb8340934 200260 net standard
openssh_10.2p1-6.debian.tar.xz
0caa6d8a73061995d006b898d7c7f103 49092260 net standard
openssh_10.2p1-6.git.tar.xz
ccc6abc3a08522db6b0fc62b30ce8db6 17335 net standard
openssh_10.2p1-6_source.buildinfo
Git-Tag-Info: tag=77b7ab9718429862c6d2e8d9ee39cdf8a50f20a1
fp=ac0a4ff12611b6fccf01c111393587d97d86500b
Git-Tag-Tagger: Colin Watson <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmnGzJMACgkQYG0ITkaD
wHliCxAAr2IIcDfYfQD/kWlEDimFgNiR2MKyTESIKTe7FLi9ju+9XE3Qvs4ITl92
3UwJBmS6zIPav95GjxN+ZM3Xn8z9xEofRytlpUnURpWOuRf+m2tuHt9EuPhbiWcV
qx6eombW6fUAisRnLvz75RnsaNE7eFVujis045ArmxtpASVfZhhJpyldevxyK12O
h/i5omqlComqGuzmDuaZsxeTq4lFagIHB7ZeR0hl8rc3g3rMiz9ufgZhgG9DU9M3
1xLPwt0BMiU3vKWXbHaSSPx3DU9Rs6SzaiE7ugHg1pdguEpUzFOphQEfKqBwuNrz
edSCuW2uRICKjrKMx9C4W/HsIR4kzKdOzpVhmWv0zLw5r5mk6TCmSJEJOaQm2/oR
rIMUmt7Yokw9VWzweXrUxKYGcDRzMUrxPgHxOqClIqX+sCZknW+iStrYHx/PK2x+
u9ud0GklLc1JesbrSB4b2w4CfhY8ZSUERtz8TG7RbTebyF+BGz/OKT8C/ahae/S3
/lZwtJHXvgaED5voyAblJcGA9SoeCORiaUuRmdosecJPOe/w1ZAVI9LWLSOhj2Bh
6Gn34/kzi3+5WkMB7mWqiZALoShXghTZt+2Bib37uCuGJL0uIxqktElKxryDJlei
zkpBf61YXhQ9b6fZh7WXZgl78Pzopb1UYXsY14Mvcy6up6za9IM=
=4rbj
-----END PGP SIGNATURE-----
pgpz56MYeiIXL.pgp
Description: PGP signature
--- End Message ---
