Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package apache-sshd for openSUSE:Factory checked in at 2026-10-01 16:44:10 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/apache-sshd (Old) and /work/SRC/openSUSE:Factory/.apache-sshd.new.1253 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "apache-sshd" Thu Oct 1 16:44:10 2026 rev:16 rq:1381671 version:2.20.0 Changes: -------- --- /work/SRC/openSUSE:Factory/apache-sshd/apache-sshd.changes 2026-07-22 19:07:50.178670207 +0200 +++ /work/SRC/openSUSE:Factory/.apache-sshd.new.1253/apache-sshd.changes 2026-10-01 16:45:15.872562977 +0200 @@ -1,0 +2,41 @@ +Wed Sep 30 11:32:23 UTC 2026 - Fridrich Strba <[email protected]> + +- Update to upstream version 2.20.0 + * CVEs + + bsc#1283357, CVE-2026-77185: Asynchronous authentication can + bypass signature verification + + bsc#1283352, CVE-2026-93994: Repeated-publickey policy bypass + on server + + bsc#1283350, CVE-2026-93995: Remote execution of JGit "archive + -o=file.zip" can write file on the server + + bsc#1283348, CVE-2026-93996: Memory exhaustion DoS via + unbounded SCP command line read + + bsc#1283347, CVE-2026-94002: Memory exhaustion in SFTP client + via unsolicited SFTP replies + + bsc#1283346, CVE-2026-94029: Memory exhaustion in SFTP v6 + check-file-name/check-file-handle extension + + bsc#1283345, CVE-2026-94052: LDAP password authentication + ineffective + + bsc#1283344, CVE-2026-94053: LDAP injection in sshd-ldap + * Bug Fixes + + GH-656 ChannelPipedInputStream: shrink buffer when emptied + + GH-906 Fix finding a signature factory for BC ed25519 keys + + GH-911 Fix server-side SOCKS5 proxy for fragmented and + pipelined CONNECT requests + + Allow asynchronous authentication only for password and + keyboard-interactive authentication schemes + + Fix authentication requiring multiple public keys + (server-side) + + Better argument handling in sshd-git + + More checks in authentication (server-side) + + Better SCP command handling + + SFTP client: simplify response message handling + + Fix check-file-name/check-file-handle SFTP v6 extension + (server-side) + + Improve LDAP authentication (sshd-ldap) + * New Features + + GH-905 Implement the "from" and "expiry-time" options in + authorized_keys handling in public key authentication (server + side) + +------------------------------------------------------------------- Old: ---- apache-sshd-2.19.0-src.tar.gz New: ---- apache-sshd-2.20.0-src.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ apache-sshd.spec ++++++ --- /var/tmp/diff_new_pack.GFSr2e/_old 2026-10-01 16:45:17.700639610 +0200 +++ /var/tmp/diff_new_pack.GFSr2e/_new 2026-10-01 16:45:17.702639694 +0200 @@ -23,7 +23,7 @@ %bcond_with extras %endif %global homedir %{_datadir}/apache-sshd -Version: 2.19.0 +Version: 2.20.0 Release: 0 Summary: Apache SSHD # One file has ISC licensing: ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.GFSr2e/_old 2026-10-01 16:45:17.871646779 +0200 +++ /var/tmp/diff_new_pack.GFSr2e/_new 2026-10-01 16:45:17.887647449 +0200 @@ -1,6 +1,6 @@ -mtime: 1784698340 -commit: d531f29d9dcda09f924bdae2c3232b7d37a320913ebf23fa0f88760f5aadcb0b +mtime: 1790769502 +commit: 65022a8fc11587ecff04212710dc0b398b0aef473a9e5f0261a93a3706c9b55d url: https://src.opensuse.org/java-packages/apache-sshd -revision: d531f29d9dcda09f924bdae2c3232b7d37a320913ebf23fa0f88760f5aadcb0b +revision: 65022a8fc11587ecff04212710dc0b398b0aef473a9e5f0261a93a3706c9b55d projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ apache-sshd-2.19.0-src.tar.gz -> apache-sshd-2.20.0-src.tar.gz ++++++ ++++ 3170 lines of diff (skipped) ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-09-30 13:58:22.000000000 +0200 @@ -0,0 +1 @@ +.osc
