Public bug reported: This brings in security and bug fixes.
https://www.openssh.org/releasenotes.html openssh (1:10.5p1-1) unstable; urgency=medium * New upstream release (closes: #1144192): - CVE-2026-73281: ssh-agent(1): fix an interaction between agent locking and the [email protected] extension that is used to identify forwarded agents. These binding requests were refused when the agent was locked, with the result that operations that were intended to be limited to local use only could be performed remotely, including the ability to add PKCS#11 tokens and make use of keys that had destination restrictions applied. - CVE-2026-73282: ssh(1): avoid potential realloc use-after-free in the client if a remote forwarding is added via the local session multiplexing socket while a remote forwarding open request is pending with the server. - CVE-2026-73283: sshd(8): make the authorized_keys "restrict" keyword apply correctly to tunnel forwarding too (which is administratively disabled by default). - ssh-keygen(1): add ability to set or clear the touch-required and verify-required flags on FIDO private keys when resetting a private key's passphrase. - ssh(1): tweak ordering of certificates tried during pubkey authentication to prefer FIDO keys that do not require user presence (touch) first, and FIDO keys that require user verification via PIN or biometrics last. This effectively tries low-friction authenticators before higher friction ones. - ssh(1): add a "ssh -Z user@host" mode that prints the keys that will be tried for public key authentication in the order that they will be used. - sshd(8) use setproctitle(3) to identify sshd-session when it's acting as a post-authentication monitor. - ssh-keyscan(1): make reading the server banner a non-blocking operation to prevent a stuck server from blocking a many-host keyscan from proceeding. - sshd(8): use sshpkt_fatal() instead of plain fatal() for errors in the packet code as this provides context of the failing peer (address, port, user, etc). - sshd(8): when signing hostkey proofs for a client UpdateHostKeys request, allow each hostkey to perform at most one signature operation. - ssh-keygen(1): pass back errors from ed25519 key generation, which theoretically can fail. - sshd(8): move check of public key type against allowed algorithms to before parsing of the key sent by the peer. This removes at least some key parsing and verification paths from the pre-auth attack surface. - ssh-keygen(1): fix double frees (impossible to reach outside of a test harness), and also use freezero where possible. - sshd(8): fix ChannelTimeout and RekeyLimit not being applied in sshd_config Match blocks. - sshd(8): in sshd config dump mode, write all directives in mixed case for consistency. - sshd(8): re-allow PAMServiceName inside a Match block, which was incorrectly disabled during a refactoring in openssh-10.4. -- Colin Watson <[email protected]> Mon, 31 Aug 2026 20:53:27 +0100 ** Affects: openssh (Ubuntu) Importance: High Assignee: Andreas Hasenack (ahasenack) Status: In Progress ** Tags: needs-merge -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2166081 Title: Fourth openssh merge from debian for stonking To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2166081/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
