[24.10] openssh: bump to 9.9p2 #26103
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Starting with OpenSSH 9.8 sessions are handled by a separate binary called sshd-session Signed-off-by: Erik Karlsson <[email protected]> (cherry picked from commit 3ac8092)
Imitate dropbear init.d-script and make sure we don't end up with corrupt keys. This can happen if we use a caching filesystem, like 'ubifs', and the DUT is powered off during boot-up. Signed-off-by: Markus Gothe <[email protected]> (cherry picked from commit 69c29a5)
The -r option is not required here but should also not hurt, since it was already tested, that $key is a file. However, to express the intent of the command more clearly, let's drop it. Signed-off-by: Michael Heimpold <[email protected]> (cherry picked from commit 9ef2d15)
Updated and removed upstreamed patch. Highlights relating to security: * Fix CVE-2025-26465 - ssh(1) in OpenSSH versions 6.8p1 to 9.9p1 (inclusive) contained a logic error that allowed an on-path attacker (a.k.a MITM) to impersonate any server when the VerifyHostKeyDNS option is enabled. This option is off by default. * Fix CVE-2025-26466 - sshd(8) in OpenSSH versions 9.5p1 to 9.9p1 (inclusive) is vulnerable to a memory/CPU denial-of-service related to the handling of SSH2_MSG_PING packets. This condition may be mitigated using the existing PerSourcePenalties feature. Both vulnerabilities were discovered and demonstrated to be exploitable by the Qualys Security Advisory team. We thank them for their detailed review of OpenSSH. Full release notes: https://www.openssh.com/txt/release-9.9p2 Signed-off-by: John Audia <[email protected]> (cherry picked from commit 67784bf)
|
CI failures seem unrelated: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Maintainer: @SibrenVasse, @tripolar
Compile tested: x86_64
Run tested: x86_64
Description:
The last few commits were cherry-picked from master as the most recent (bumping to 9.9p2) contains security fixes.
Brought in a few recent bug fixes as well; I could limit it to just the version bump if needed.