On 8/10/26 21:40, Damien Miller wrote:
Changes since OpenSSH 10.4
==========================
This release contains a number of security fixes and small bugfixes.
Security
========
MITRE has now published CVE ids for these:
* ssh-agent(1): fix an interaction between agent locking and the
[email protected] extension that is used to identify
forwarded agents. These binding requests were refused when the
agent was locked, with the result that operations that were
intended to be limited to local use only could be performed
remotely, including the ability to add PKCS#11 tokens and make
use of keys that had destination restrictions applied.
Reported by sn0x-sharma
https://www.cve.org/CVERecord?id=CVE-2026-73281
* ssh(1): avoid potential realloc use-after-free in the client if a
remote forwarding is added via the local session multiplexing
socket while a remote forwarding open request is pending with the
server. Report and fix from Brian Mingus of Cognatory
https://www.cve.org/CVERecord?id=CVE-2026-73282
* sshd(8): make the authorized_keys "restrict" keyword apply
correctly to tunnel forwarding too (which is administratively
disabled by default). Reported by Erichen, Institute of Computing
Technology, Chinese Academy of Sciences
https://www.cve.org/CVERecord?id=CVE-2026-73283
--
-Alan Coopersmith- [email protected]
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
