Your message dated Mon, 31 Aug 2026 20:38:04 +0000
with message-id <[email protected]>
and subject line Bug#1144192: fixed in openssh 1:10.5p1-1
has caused the Debian Bug report #1144192,
regarding openssh: CVE-2026-73281 CVE-2026-73282 CVE-2026-73283
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144192: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144192
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: openssh
Version: 1:10.4p1-4
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for openssh.
CVE-2026-73281[0]:
| In ssh-agent in OpenSSH before 10.5, some operations can occur
| remotely but were intended to occur only locally, including
| operations that add tokens or use keys. This is caused by
| misinteraction between agent locking and the session-
| [email protected] extension.
CVE-2026-73282[1]:
| In ssh in OpenSSH before 10.5, a use-after-free for realloc data can
| occur if a certain pair of remote-forwarding operations are
| concurrent.
CVE-2026-73283[2]:
| In sshd in OpenSSH before 10.5, the restrict keyword (in
| authorized_keys) was supposed to be applicable to tunnel forwarding
| but was not.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-73281
https://www.cve.org/CVERecord?id=CVE-2026-73281
[1] https://security-tracker.debian.org/tracker/CVE-2026-73282
https://www.cve.org/CVERecord?id=CVE-2026-73282
[2] https://security-tracker.debian.org/tracker/CVE-2026-73283
https://www.cve.org/CVERecord?id=CVE-2026-73283
[3] https://www.openwall.com/lists/oss-security/2026/08/12/1
[4] https://www.openssh.org/releasenotes.html#10.5
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: openssh
Source-Version: 1:10.5p1-1
Done: Colin Watson <[email protected]>
We believe that the bug you reported is fixed in the latest version of
openssh, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Colin Watson <[email protected]> (supplier of updated openssh package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 31 Aug 2026 20:53:27 +0100
Source: openssh
Architecture: source
Version: 1:10.5p1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenSSH Maintainers <[email protected]>
Changed-By: Colin Watson <[email protected]>
Closes: 1144192
Changes:
openssh (1:10.5p1-1) unstable; urgency=medium
.
* New upstream release (closes: #1144192):
- CVE-2026-73281: ssh-agent(1): fix an interaction between agent locking
and the [email protected] extension that is used to identify
forwarded agents. These binding requests were refused when the agent
was locked, with the result that operations that were intended to be
limited to local use only could be performed remotely, including the
ability to add PKCS#11 tokens and make use of keys that had
destination restrictions applied.
- CVE-2026-73282: ssh(1): avoid potential realloc use-after-free in the
client if a remote forwarding is added via the local session
multiplexing socket while a remote forwarding open request is pending
with the server.
- CVE-2026-73283: sshd(8): make the authorized_keys "restrict" keyword
apply correctly to tunnel forwarding too (which is administratively
disabled by default).
- ssh-keygen(1): add ability to set or clear the touch-required and
verify-required flags on FIDO private keys when resetting a private
key's passphrase.
- ssh(1): tweak ordering of certificates tried during pubkey
authentication to prefer FIDO keys that do not require user presence
(touch) first, and FIDO keys that require user verification via PIN or
biometrics last. This effectively tries low-friction authenticators
before higher friction ones.
- ssh(1): add a "ssh -Z user@host" mode that prints the keys that will
be tried for public key authentication in the order that they will be
used.
- sshd(8) use setproctitle(3) to identify sshd-session when it's acting
as a post-authentication monitor.
- ssh-keyscan(1): make reading the server banner a non-blocking
operation to prevent a stuck server from blocking a many-host keyscan
from proceeding.
- sshd(8): use sshpkt_fatal() instead of plain fatal() for errors in the
packet code as this provides context of the failing peer (address,
port, user, etc).
- sshd(8): when signing hostkey proofs for a client UpdateHostKeys
request, allow each hostkey to perform at most one signature
operation.
- ssh-keygen(1): pass back errors from ed25519 key generation, which
theoretically can fail.
- sshd(8): move check of public key type against allowed algorithms to
before parsing of the key sent by the peer. This removes at least some
key parsing and verification paths from the pre-auth attack surface.
- ssh-keygen(1): fix double frees (impossible to reach outside of a test
harness), and also use freezero where possible.
- sshd(8): fix ChannelTimeout and RekeyLimit not being applied in
sshd_config Match blocks.
- sshd(8): in sshd config dump mode, write all directives in mixed case
for consistency.
- sshd(8): re-allow PAMServiceName inside a Match block, which was
incorrectly disabled during a refactoring in openssh-10.4.
Checksums-Sha1:
1a0c61774dc20674828e4aed57fb3069aa2fb03e 3372 openssh_10.5p1-1.dsc
008850ac30739d6425cc782106238abbb74cd859 1632424 openssh_10.5p1.orig.tar.xz
d2a2b743ca3f52b38c7b49d4d781f03f8b4a015a 186560 openssh_10.5p1-1.debian.tar.xz
e1cd79d9cf317944d838689eea6f8ee0215dc5fa 5341740 openssh_10.5p1-1.git.tar.xz
8a800dd46ddb541bd8d493c07be84a10c26700ad 17674
openssh_10.5p1-1_source.buildinfo
Checksums-Sha256:
15a621f5d4c298127b57740e271ef571760686133f344a4841aa8e96af0ad532 3372
openssh_10.5p1-1.dsc
9643e644c20dfef1271eaccc488ae4cebc9b5352b800c30771233880d985c74c 1632424
openssh_10.5p1.orig.tar.xz
4b19dea2fc78e93687d7f9e103542136d863e3d5c95e7d7be6088ac7979fb0cc 186560
openssh_10.5p1-1.debian.tar.xz
e4b36f4d32ecf12fd7d0e7fa9277f8219d05aa2bbb24407ce5ea5c34b3866be1 5341740
openssh_10.5p1-1.git.tar.xz
e98487aea017c83e4e6fe231975241586e5e59a5df530a68393f673217df81ff 17674
openssh_10.5p1-1_source.buildinfo
Files:
5ad66c933e21c32ee28c104945f293a3 3372 net standard openssh_10.5p1-1.dsc
78cd1f0ed8593dccc747185e6eaa9f85 1632424 net standard
openssh_10.5p1.orig.tar.xz
382c044c2a378c229e35961b1440568a 186560 net standard
openssh_10.5p1-1.debian.tar.xz
fb4f1883a7d9044bb1d36d00920447ab 5341740 net standard
openssh_10.5p1-1.git.tar.xz
feb9577324b8413ec70d5399bd52c388 17674 net standard
openssh_10.5p1-1_source.buildinfo
Git-Tag-Info: tag=55ac9c3d5b472bef5025f867b8ba0a39ba07ec48
fp=ac0a4ff12611b6fccf01c111393587d97d86500b
Git-Tag-Tagger: Colin Watson <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqV3JgACgkQYG0ITkaD
wHnC9hAAsOzMV7ACyYGj/slN4HfwNW3jwCys/ZrLnVGPrnRg4U6B+8njIIRktfHr
i2qgY7U9/QkJd3cwdRXQx3CTwk5UfZQAmcFKna0cZGq+QJuWL5uE67FKPC7HGaC+
uHgqYzCOxsxt9nS11q8R51DzilbpcI1ihv2Mz0q4M47/AwKicCXJoGjfSqBjxhjY
UhrJF2nEEKBFbEx3DX7C2bJFBzG7kv8m5/HhRF59YBw2YuBxxi9/hRfKH0Ym0uxB
PMDUEFtSFDoH9PIqju/spKHGfzzDnLfLZz6XnqCmXQDoIgJXGdzjL+7pzLHjAJkd
HlhQjthHmBDN6tXgAnPNxsqyWGUZ2dmfyei2cuoD87Rmr9Xo3kJrzJSb6BLhhNxu
KEkYaASHgBHI0JPyQWRw/EIpWU8O5ABXWvsC5HXp/qJVwqhFNXdv7r9KDKd+ek/W
ditzwUp+BFl2H32aiWbybvpYxmPhagwRFwgDwKk+lIZwwXfK8H9l7UM+8xhVGAb3
Uur/4CWb376wX7P1I23UhuKY7f1ny/LvaOPm76N/JHzdetdkY8ub4LFqAA6JjAiZ
huUVgK+IaAkoSg9UAym2mq0qNzLIVNQHoeesDGsWGEKM9ptXtU3/MqnYXRhdZvJ0
yiEkcu+mV5Jq3EVG7BPfRbrnmdFsFl+mCkGwhYfMcQ4LYXncxp4=
=nLdL
-----END PGP SIGNATURE-----
pgpwTsJjEupFY.pgp
Description: PGP signature
--- End Message ---
