Your message dated Mon, 31 Aug 2026 23:04:43 +0000
with message-id <[email protected]>
and subject line Bug#1144192: fixed in openssh-gssapi 1:10.5p1-1
has caused the Debian Bug report #1144192,
regarding openssh: CVE-2026-73281 CVE-2026-73282 CVE-2026-73283
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144192: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144192
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: openssh
Version: 1:10.4p1-4
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for openssh.
CVE-2026-73281[0]:
| In ssh-agent in OpenSSH before 10.5, some operations can occur
| remotely but were intended to occur only locally, including
| operations that add tokens or use keys. This is caused by
| misinteraction between agent locking and the session-
| [email protected] extension.
CVE-2026-73282[1]:
| In ssh in OpenSSH before 10.5, a use-after-free for realloc data can
| occur if a certain pair of remote-forwarding operations are
| concurrent.
CVE-2026-73283[2]:
| In sshd in OpenSSH before 10.5, the restrict keyword (in
| authorized_keys) was supposed to be applicable to tunnel forwarding
| but was not.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-73281
https://www.cve.org/CVERecord?id=CVE-2026-73281
[1] https://security-tracker.debian.org/tracker/CVE-2026-73282
https://www.cve.org/CVERecord?id=CVE-2026-73282
[2] https://security-tracker.debian.org/tracker/CVE-2026-73283
https://www.cve.org/CVERecord?id=CVE-2026-73283
[3] https://www.openwall.com/lists/oss-security/2026/08/12/1
[4] https://www.openssh.org/releasenotes.html#10.5
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: openssh-gssapi
Source-Version: 1:10.5p1-1
Done: Colin Watson <[email protected]>
We believe that the bug you reported is fixed in the latest version of
openssh-gssapi, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Colin Watson <[email protected]> (supplier of updated openssh-gssapi package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 31 Aug 2026 23:45:36 +0100
Source: openssh-gssapi
Architecture: source
Version: 1:10.5p1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenSSH Maintainers <[email protected]>
Changed-By: Colin Watson <[email protected]>
Closes: 1144192
Changes:
openssh-gssapi (1:10.5p1-1) unstable; urgency=medium
.
* password-auth-no-pam: Run test daemon via systemd.
* New upstream release (closes: #1144192):
- CVE-2026-73281: ssh-agent(1): fix an interaction between agent locking
and the [email protected] extension that is used to identify
forwarded agents. These binding requests were refused when the agent
was locked, with the result that operations that were intended to be
limited to local use only could be performed remotely, including the
ability to add PKCS#11 tokens and make use of keys that had
destination restrictions applied.
- CVE-2026-73282: ssh(1): avoid potential realloc use-after-free in the
client if a remote forwarding is added via the local session
multiplexing socket while a remote forwarding open request is pending
with the server.
- CVE-2026-73283: sshd(8): make the authorized_keys "restrict" keyword
apply correctly to tunnel forwarding too (which is administratively
disabled by default).
- ssh-keygen(1): add ability to set or clear the touch-required and
verify-required flags on FIDO private keys when resetting a private
key's passphrase.
- ssh(1): tweak ordering of certificates tried during pubkey
authentication to prefer FIDO keys that do not require user presence
(touch) first, and FIDO keys that require user verification via PIN or
biometrics last. This effectively tries low-friction authenticators
before higher friction ones.
- ssh(1): add a "ssh -Z user@host" mode that prints the keys that will
be tried for public key authentication in the order that they will be
used.
- sshd(8) use setproctitle(3) to identify sshd-session when it's acting
as a post-authentication monitor.
- ssh-keyscan(1): make reading the server banner a non-blocking
operation to prevent a stuck server from blocking a many-host keyscan
from proceeding.
- sshd(8): use sshpkt_fatal() instead of plain fatal() for errors in the
packet code as this provides context of the failing peer (address,
port, user, etc).
- sshd(8): when signing hostkey proofs for a client UpdateHostKeys
request, allow each hostkey to perform at most one signature
operation.
- ssh-keygen(1): pass back errors from ed25519 key generation, which
theoretically can fail.
- sshd(8): move check of public key type against allowed algorithms to
before parsing of the key sent by the peer. This removes at least some
key parsing and verification paths from the pre-auth attack surface.
- ssh-keygen(1): fix double frees (impossible to reach outside of a test
harness), and also use freezero where possible.
- sshd(8): fix ChannelTimeout and RekeyLimit not being applied in
sshd_config Match blocks.
- sshd(8): in sshd config dump mode, write all directives in mixed case
for consistency.
- sshd(8): re-allow PAMServiceName inside a Match block, which was
incorrectly disabled during a refactoring in openssh-10.4.
Checksums-Sha1:
d2b61f61659206c60c1d27c44ae1d26ee7a0fe2c 2971 openssh-gssapi_10.5p1-1.dsc
e977a002fdff1d065e81c436b929e7e255c4286e 1632904
openssh-gssapi_10.5p1.orig.tar.xz
69a811f167449a949b0e1b086381395964882822 199088
openssh-gssapi_10.5p1-1.debian.tar.xz
2789546535adf5d1619b3a09471b2c35062cc1bf 5350264
openssh-gssapi_10.5p1-1.git.tar.xz
f43c4c904b7d0993ad77270f90756e044637e097 17702
openssh-gssapi_10.5p1-1_source.buildinfo
Checksums-Sha256:
86207a0b2b87fd347af580dc90e40c0bdc0259822ddda3910c43c4a0eac209c8 2971
openssh-gssapi_10.5p1-1.dsc
0a6257ccf7a3ec7b7da29b78c3f67287e55e88f0f88ba982afbab524ab9555f1 1632904
openssh-gssapi_10.5p1.orig.tar.xz
a9bfec7c61caa99600712abcd8b8ddd3e10890ef79617e6ca3e68552f283134e 199088
openssh-gssapi_10.5p1-1.debian.tar.xz
18c1c6c0e8c59366764993968b07abd5ded8f174878d0ce2f7dfeac3c5da9cbe 5350264
openssh-gssapi_10.5p1-1.git.tar.xz
1b885caa9800726744b5adfc2b287540d4171b1c185995a11be2029fce268647 17702
openssh-gssapi_10.5p1-1_source.buildinfo
Files:
8353133366f75ab1dbbb2a3d7c9fc305 2971 net optional openssh-gssapi_10.5p1-1.dsc
480e772a34d02b9e05f39b25903f7618 1632904 net optional
openssh-gssapi_10.5p1.orig.tar.xz
ee14bc165325fc544cce46e18c44f065 199088 net optional
openssh-gssapi_10.5p1-1.debian.tar.xz
f189fdde97eb1196133060581ff589e2 5350264 net optional
openssh-gssapi_10.5p1-1.git.tar.xz
c8f9b92a6d0f60ec713f8c6cfb0d2cb9 17702 net optional
openssh-gssapi_10.5p1-1_source.buildinfo
Git-Tag-Info: tag=31ef789f6e1f84a037865d49f7bc9173e88037db
fp=ac0a4ff12611b6fccf01c111393587d97d86500b
Git-Tag-Tagger: Colin Watson <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqWBKUACgkQYG0ITkaD
wHlcwxAAuFhhOB8mNpjqbL96CXXd2eCN39ugKK5+JLl5PXk9ycBo3KJGVqXhqjEN
dQpXb7rEilqQXDEABp4W4Q93O/C2Z3imQoKegaAytTnYemzUPzIDkq9oLC9gTN0+
gQ1ckGAFCnBVRybkeAXtmQx6yxDaY1tZ4yUQIzIMr4Tl/4WNniRYiMEvLZokqZYh
kPSVL2Wj5GTnQNEfvNN4hz6mbvktDCSrIqQcwPm0CCJDOR1HckUtJYb9GjeByAmn
G38Wm7gY8NKPDZC0iy7HfdEX+/SORpWtbjjgmnbn1cZjCgAtObwMeMBkl3w34qnP
BYMSCzwzg5d9L/HxSv4TrGrSZfuEbjFBaA6MxPtgLiIpuLGdqhtjPvioXVMJwS2o
R09lmioxNEBDOrFYVqcx4uhjyo/xjtIcLHRIKRZmMT2O2WTdz6W0tC8ECBTpaufn
Z7Gb4iNoTiHWMtCNlgxSBp6fbGNRSkPQdlkrbN9YyotTLXcX5/ggzIVSExajpG/Y
jptd+DVbGYHGUp7nGhkRI+mZWKX1WCT1XXxVaFEdZcq2H5o6TeFDdbXZh32zrCGd
fC6S8+R3PwigwkQErXU+8igVeRBJTYG024eZ36bB7rSyu/zG763uinmKARmzEupz
H4lNMGb7LNkaJfNR0OO8SrZr9c9PbUZdcRAaEqisd0oPPibhrho=
=a/HO
-----END PGP SIGNATURE-----
pgpOhqRvd6YNx.pgp
Description: PGP signature
--- End Message ---
