Slackware alert SSA:2026-187-02 (openssh)
| From: | Slackware Security Team <security@slackware.com> | |
| To: | slackware-security@slackware.com | |
| Subject: | [slackware-security] openssh (SSA:2026-187-02) | |
| Date: | Mon, 06 Jul 2026 15:51:23 -0700 | |
| Message-ID: | <alpine.LNX.2.02.2607061551050.23492@connie.slackware.com> |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] openssh (SSA:2026-187-02) New openssh packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: +--------------------------+ patches/packages/openssh-10.4p1-i586-1_slack15.0.txz: Upgraded. This release contains a number of security fixes: sftp(1): when downloading files on the command-line using "sftp host:/path .", a malicious server could cause the file to be downloaded to an unexpected location. This issue was identified by the Swival Security Scanner. scp(1): when copying files between two remote destinations, do not allow a malicious server to write files to the parent directory of the intended target directory. This issue was identified by the Swival Security Scanner. sshd(8): when using the "internal-sftp" SFTP server implementation (this is not the default), long command lines were previously truncated silently after the 9th argument. If a security-relevant option was in the 10th or later position, it would be discarded. Reported by Steve Caffrey. sshd(8): add a documentation note to mention that the GSSAPIStrictAcceptorCheck option is ineffective when the server is joined to a Windows Active Directory. Reported by Yarin Aharoni of Safebreach. sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes as it was documented to do. Note that PermitTunnel is not enabled by default. Reported independently by Huzaifa Sidhpurwala of Redhat and Marko Jevtic. sshd(8): avoid a potential pre-authentication denial of service when GSSAPIAuthentication was enabled (this feature is off by default). This was not mitigated by MaxAuthTries, but would be penalised by PerSourcePenalties. This was reported by Manfred Kaiser of the milCERT AT (Austrian Ministry of Defence). sshd(8): fix a number of cases where the minimum authentication delay was not being enforced. Reported by the Orange Cyberdefense Vulnerability Team. ssh(1): fix a possible client-side use-after-free if the server changes its host key during a key reexchange. This was reported by Zhenpeng (Leo) Lin of Depthfirst. For more information, see: https://www.openssh.org/releasenotes.html#10.4 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 15.0: ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patc... Updated package for Slackware x86_64 15.0: ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/pa... Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/s... Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current... MD5 signatures: +-------------+ Slackware 15.0 package: eb8d3bbfb4cf2885d0ec7870a35e8a3f openssh-10.4p1-i586-1_slack15.0.txz Slackware x86_64 15.0 package: 82ca7dcca95f4b0d7c6e2a56008d2ab3 openssh-10.4p1-x86_64-1_slack15.0.txz Slackware -current package: bdb19fd0e66d17df0b5ce744eff0c9c6 n/openssh-10.4p1-i686-1.txz Slackware x86_64 -current package: 74bc62b8dbefd17861c72de5568f6dc7 n/openssh-10.4p1-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg openssh-10.4p1-i586-1_slack15.0.txz Next, restart the sshd daemon: # sh /etc/rc.d/rc.sshd restart +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com +------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. | +------------------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- iHkEARECADkWIQTsVknaQB4iq/pnNu9qRGPAQBAiMwUCakwwyRsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDIACgkQakRjwEAQIjOavgCglYhakfm79Czh+a6kt/u4 VuiVlScAn2GGe/MUwYHE7kuHqPdnOJ8fMVe1 =FpbG -----END PGP SIGNATURE-----