I reviewed openssh-gssapi 1:10.5p1-1ubuntu3 as checked into stonking.
This shouldn't be considered a full audit but rather a quick gauge of
maintainability.
src:openssh-gssapi is built from the same orig tarball as src:openssh and
shares all but three patches with it, so I used src:openssh
1:10.5p1-1ubuntu3 as the baseline and focused on the delta: the three
GSSAPI patches, the --with-kerberos5 build and the packaging differences.
openssh-gssapi is the Kerberos/GSS-API flavour of OpenSSH, split out of
src:openssh by Debian so that plain openssh no longer carries the
GSSAPI pre-auth attack surface.
- CVE History
- The OpenSSH 10.6 CVEs affect both openssh and openssh-gssapi
10.5p1, including the GSSAPI specific CVE-2026-106553 and
CVE-2026-106555. They were fixed for jammy, noble and resolute in
USN-8928-1; updates for both source packages in stonking are being
prepared by the security team.
- CVE-2026-3497 (distro GSS KEX patch): fixed.
- Build-Depends
- OK. Adds libkrb5-dev (src:krb5, main); not linked into the setuid
ssh-keysign.
- pre/post inst/rm scripts
- OK. Same as src:openssh, postrm skips purge when the counterpart is
installed.
- init scripts
- OK.
- systemd units
- OK.
- dbus services
- None.
- setuid binaries
- ssh-keysign, same as src:openssh.
- binaries in PATH
- No additional binaries compared to plain openssh.
- sudo fragments
- None.
- polkit files
- None.
- udev rules
- None.
- unit tests / autopkgtests
- OK. src:openssh tests plus GSSAPI auth, GSS key exchange and ccache
tests against a local KDC. The KerberosAuthentication path is not
covered.
- cron jobs
- None.
- Build logs
- OK. Full hardening.
- Processes spawned
- None added compared to plain openssh.
- Memory management
- auth-krb5.c (ccache patch) has fragile string handling in
krb5_cleanup_proc (strncpy/strcat into a 128 byte stack buffer) and
some unchecked return values. Input is root-controlled krb5.conf and
the path needs KerberosAuthentication, so low severity. Worth fixing
upstream (Fedora).
- File IO
- Credential cache creation, cleanup and update run with the user's
effective ids (temporarily_use_uid). The fallback is the historic
mkstemp() in /tmp with a 0177 umask. OK.
- Logging
- Peer supplied GSSAPI error text is escaped. OK.
- Environment variable usage
- KRB5CCNAME is cleared at startup and only set from sshd's own ccache
name. OK.
- Use of privileged functions
- GSSAPI primitives run in the root monitor, gated on the GSSAPI
options and auth state. Seccomp sandbox unchanged.
- Use of cryptography / random number sources etc
- OK. With GSS key exchange the client trusts Kerberos mutual auth
instead of known_hosts (by design, opt-in).
- Use of temp files
- mkstemp() ccache in /tmp, created as the user. OK.
- Use of networking
- With GSSAPIKeyExchange enabled, pre-auth GSSAPI tokens are processed
by the root monitor. Inherent to the feature and the reason for the
split; off by default.
- Use of WebKit
- None.
- Use of PolicyKit
- None.
- Any significant cppcheck results
- None.
- Any significant Coverity results
- None.
- Any significant shellcheck results
- None.
- Any significant bandit results
- None.
- Any significant govulncheck results
- N/A.
- Any significant Semgrep results
- None.
This is a well known codebase with a long security track record, and the
GSSAPI patches have been carried by Debian, Fedora and Ubuntu (src:openssh
in main up to resolute) for many years. Splitting them out reduces the
exposure of the default openssh install. The extra cost is duplicated
maintenance: security fixes must land in both sources.
Security team ACK for promoting openssh-gssapi to main in stonking.
** CVE added: https://cve.org/CVERecord?id=CVE-2026-106553
** CVE added: https://cve.org/CVERecord?id=CVE-2026-106555
** CVE added: https://cve.org/CVERecord?id=CVE-2026-3497
** Changed in: openssh-gssapi (Ubuntu)
Status: New => In Progress
** Changed in: openssh-gssapi (Ubuntu)
Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167624
Title:
MIR (source fork): openssh-gssapi + ccache patch (the new thing)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2167624/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
