Back to openssh PTS page

Accepted openssh 1:9.3p1-1 (source) into unstable

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 20 Jun 2023 01:01:48 +0100
Source: openssh
Architecture: source
Version: 1:9.3p1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>
Changed-By: Colin Watson <cjwatson@debian.org>
Closes: 909022 959726 1001186 1033166 1033178 1034425
Changes:
 openssh (1:9.3p1-1) unstable; urgency=medium
 .
   * Debconf translations:
     - Romanian (thanks, Remus-Gabriel Chelu; closes: #1033178).
   * Properly fix date of 1:3.0.2p1-2 changelog entry (closes: #1034425).
   * New upstream release (https://www.openssh.com/releasenotes.html#9.3p1):
     - [CVE-2023-28531] ssh-add(1): when adding smartcard keys to
       ssh-agent(1) with the per-hop destination constraints (ssh-add -h ...)
       added in OpenSSH 8.9, a logic error prevented the constraints from
       being communicated to the agent. This resulted in the keys being added
       without constraints. The common cases of non-smartcard keys and keys
       without destination constraints are unaffected. This problem was
       reported by Luci Stanescu (closes: #1033166).
     - [SECURITY] ssh(1): Portable OpenSSH provides an implementation of the
       getrrsetbyname(3) function if the standard library does not provide
       it, for use by the VerifyHostKeyDNS feature. A specifically crafted
       DNS response could cause this function to perform an out-of-bounds
       read of adjacent stack data, but this condition does not appear to be
       exploitable beyond denial-of-service to the ssh(1) client.
     - ssh-keygen(1), ssh-keyscan(1): accept -Ohashalg=sha1|sha256 when
       outputting SSHFP fingerprints to allow algorithm selection.
     - sshd(8): add a `sshd -G` option that parses and prints the effective
       configuration without attempting to load private keys and perform
       other checks. This allows usage of the option before keys have been
       generated and for configuration evaluation and verification by
       unprivileged users.
     - scp(1), sftp(1): fix progressmeter corruption on wide displays.
     - ssh-add(1), ssh-keygen(1): use RSA/SHA256 when testing usability of
       private keys as some systems are starting to disable RSA/SHA1 in
       libcrypto.
     - sftp-server(8): fix a memory leak.
     - ssh(1), sshd(8), ssh-keyscan(1): remove vestigial protocol
       compatibility code and simplify what's left.
     - Fix a number of low-impact Coverity static analysis findings.
     - ssh_config(5), sshd_config(5): mention that some options are not
       first-match-wins.
     - Rework logging for the regression tests. Regression tests will now
       capture separate logs for each ssh and sshd invocation in a test.
     - ssh(1): make `ssh -Q CASignatureAlgorithms` work as the manpage says
       it should.
     - ssh(1): ensure that there is a terminating newline when adding a new
       entry to known_hosts.
     - sshd(8): harden Linux seccomp sandbox. Move to an allowlist of
       mmap(2), madvise(2) and futex(2) flags, removing some concerning
       kernel attack surface.
   * debian/README.Debian: Clarify that you need to restart ssh.socket after
     overriding its ListenStream= option (LP: #2020560).
   * debian/openssh-server.postinst: Use "sshd -G" to parse the server
     configuration file (closes: #959726).
   * Fix incorrect RRSET_FORCE_EDNS0 flags validation in SSHFP DNSSEC patch
     (thanks, Ben Hutchings; closes: #909022).
   * Always use the internal mkdtemp implementation, since it substitutes
     more randomness into the template string than glibc's version (closes:
     #1001186).
Checksums-Sha1:
 ab3a7ebc6246958e15896b814213ca3e6a612f63 3312 openssh_9.3p1-1.dsc
 610959871bf8d6baafc3525811948f85b5dd84ab 1856839 openssh_9.3p1.orig.tar.gz
 31e40d5a0769d4febc8493f354b273eff0d9cab5 833 openssh_9.3p1.orig.tar.gz.asc
 b989715aa2088f32af0845b5fb6a116e80598028 183616 openssh_9.3p1-1.debian.tar.xz
Checksums-Sha256:
 a16311299ca945c2818aa4a4f2847c70a68eb3a677cfef1efd2837c4ba05faff 3312 openssh_9.3p1-1.dsc
 e9baba7701a76a51f3d85a62c383a3c9dcd97fa900b859bc7db114c1868af8a8 1856839 openssh_9.3p1.orig.tar.gz
 6d96d2ff60d8d3545f0fa1709cb4c273d9a2fe086afa90f70951cffc01c8fa68 833 openssh_9.3p1.orig.tar.gz.asc
 523656c543f08138ad65665020b34ec157fefc0117bf8b81fbea57655b73e463 183616 openssh_9.3p1-1.debian.tar.xz
Files:
 6bda98b24abb25577ce0cdd42ac849da 3312 net standard openssh_9.3p1-1.dsc
 3430d5e6e71419e28f440a42563cb553 1856839 net standard openssh_9.3p1.orig.tar.gz
 8a1aef9314a4224cf3f2936430733796 833 net standard openssh_9.3p1.orig.tar.gz.asc
 9ce700b7d9908a542ffdb28dab37387a 183616 net standard openssh_9.3p1-1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEErApP8SYRtvzPAcEROTWH2X2GUAsFAmSQ7KYACgkQOTWH2X2G
UAs68w/9HBZKKTXOJK+jOGfomE3XmqZUBgbSHv2hw6m9lk3PwudZWbfOpSBY5WY2
8k2FP8XbztxAevBizoPzC17+autWXxZtAsOlJaNElZRYBPQNuKDCg8GlMkI0v6M3
iu4UPx5FDuULyle8a5VZ995LXjrCzJni4KUDR7MFb0p8Qm+JaBBhMG39273C695e
AvdIdbh8l/Gk86ug11sb4+YSaUfkLuN/kD98TrVzYBtwpDGCaKJ8mBPiF3hMC2Og
LUpXnFvOMFC154y2XN5S27TrkLzOW8m8nUssfna0yVgcdMDOU9ymhPPeTNxe1Wpr
hMQBqyQnDvrIrYTRVx5z0fECR5YZv3vUyYWiUYsLWN53EEX0XUjcDozsnMwCqOHk
dsqZoX81sBRYeIgOLJMqkKHY59h1IeZBXxlkqdUnUiJdRoFaaWcBNHoKpLIpu5Gj
clLHIjAlmAy+MVTi0Fx88X142DRnKYm9yckVOZo1jMcYpYVITrqK44e/X/dd+/nT
P79zRydRNcwdJnGLAy4rdF4oJwhLq+v05F6I75gYdRl6W5aEB3rTb7IfhC+PMTfi
+RchHBKALvzo/1Cbv+TU0hVbdsq0RmEF4q2+uC03XjdGMTutX6EDLi5UcaSeDCbI
wwgrEYvnLc74t2sNDjzGu6dY/YfmEKAbN8snWgRag9J/bbrDQi0=
=v5AT
-----END PGP SIGNATURE-----