UbuntuUpdates.org

Package "ssh"

Name: ssh

Description:

secure shell client and server (metapackage)
Latest version: 1:9.6p1-3ubuntu13.19
Release: noble (24.04)
Level: updates
Repository: main
Head package: openssh
Homepage: https://www.openssh.com/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "ssh"

All arch deb package
APT INSTALL

Other versions of "ssh" in Noble

Repository Area Version
base main 1:9.6p1-3ubuntu13
security main 1:9.6p1-3ubuntu13.19

Changelog

Version: 1:9.6p1-3ubuntu13.13 2025-07-24 16:06:55 UTC

  openssh (1:9.6p1-3ubuntu13.13) noble; urgency=medium

  * Explicitly listen on IPv4 by default, with socket-activated sshd
    (LP: #2080216)
    - d/systemd/ssh.socket: explicitly listen on ipv4 by default
    - d/t/sshd-socket-generator: update for new defaults and AddressFamily
    - sshd-socket-generator: handle new ssh.socket default settings

 -- Nick Rosbrook <email address hidden> Mon, 09 Jun 2025 13:22:39 -0400
Source diff to previous version
2080216 sshd cannot bind to IPv4 interfaces

Version: 1:9.6p1-3ubuntu13.12 2025-06-05 22:07:31 UTC

  openssh (1:9.6p1-3ubuntu13.12) noble; urgency=medium

  * d/p/sshd-socket-generator.patch: add note to sshd_config
    Explain that a systemctl daemon-reload is needed for changes
    to Port et al to take effect.
    (LP: #2069041)

 -- Nick Rosbrook <email address hidden> Tue, 29 Apr 2025 10:57:04 -0400
Source diff to previous version
2069041 Changing Port in sshd_config requires calling systemctl daemon-reload

Version: 1:9.6p1-3ubuntu13.11 2025-04-24 17:07:41 UTC

  openssh (1:9.6p1-3ubuntu13.11) noble-security; urgency=medium

  * SECURITY UPDATE: incorrect DisableForwarding directive behaviour
    - debian/patches/CVE-2025-32728.patch: fix logic error in session.c.
    - CVE-2025-32728

 -- Marc Deslauriers <email address hidden> Tue, 22 Apr 2025 07:51:46 -0400
Source diff to previous version
CVE-2025-32728 In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwardin

Version: 1:9.6p1-3ubuntu13.9 2025-03-26 20:07:07 UTC

  openssh (1:9.6p1-3ubuntu13.9) noble; urgency=medium

  [ Lukas Märdian ]
  * d/p/gssapi.patch: Fix interaction between gssapi-keyex and pubkey auth
    (LP: #2028282)
    Don't prefer host-bound public key signatures if there was no initial
    host key, as is the case when using GSS-API key exchange.
    Thanks to Colin Watson for providing patches via Debian Salsa (7d291bb)
    + d/t/ssh-gssapi: Fix typo in autopkgtest
    + d/t/ssh-gssapi: Test interaction between gssapi-keyex and pubkey auth.

  [ Nick Rosbrook ]
  * sshd-socket-generator: do not parse server match config
    (LP: #2076023)

 -- Nick Rosbrook <email address hidden> Mon, 24 Feb 2025 16:25:09 -0500
Source diff to previous version
2028282 [SRU] SSH pubkey authetication fails when GSSAPI enabled
2076023 Failed to apply 'Match' directive in sshd_config with sshd-socket-generator

Version: 1:9.6p1-3ubuntu13.8 2025-02-18 22:07:28 UTC

  openssh (1:9.6p1-3ubuntu13.8) noble-security; urgency=medium

  * SECURITY UPDATE: MitM with VerifyHostKeyDNS option
    - debian/patches/CVE-2025-26465.patch: fix error code handling in
      krl.c, ssh-agent.c, ssh-sk-client.c, sshconnect2.c, sshsig.c.
    - CVE-2025-26465
  * SECURITY UPDATE: pre-authentication denial of service
    - debian/patches/CVE-2025-26466.patch: don't reply to PING in preauth
      or in KEX in packet.c.
    - CVE-2025-26466
  * NOTE: this package does _not_ contain the changes from
    (1:9.6p1-3ubuntu13.7) in noble-proposed.

 -- Marc Deslauriers <email address hidden> Tue, 11 Feb 2025 08:41:04 -0500
CVE-2025-26465 MitM
CVE-2025-26466 Denial of Service: asymmetric resource consumption of memory and CPU


About   -   Send Feedback to @ubuntu_updates