Re: [Buildroot] [PATCH 1/1] package/openssh: security bump to version 10.5p1

[Titouan Christophe via buildroot <buildroot@buildroot.org>]

On 16/08/26 09:53, Bernd Kuhls wrote:
> https://www.openssh.org/releasenotes.html#10.5p1
>
> Changes since OpenSSH 10.4
> ==========================
>
> This release contains a number of security fixes and small bugfixes.
>
> Security
> ========
>
>   * ssh-agent(1): fix an interaction between agent locking and the
>     session-bind@openssh.com extension that is used to identify
>     forwarded agents. These binding requests were refused when the
>     agent was locked, with the result that operations that were
>     intended to be limited to local use only could be performed
>     remotely, including the ability to add PKCS#11 tokens and make
>     use of keys that had destination restrictions applied.
>     Reported by sn0x-sharma
>
>   * ssh(1): avoid potential realloc use-after-free in the client if a
>     remote forwarding is added via the local session multiplexing
>     socket while a remote forwarding open request is pending with the
>     server. Report and fix from Brian Mingus of Cognatory
>
>   * sshd(8): make the authorized_keys "restrict" keyword apply
>     correctly to tunnel forwarding too (which is administratively
>     disabled by default). Reported by Erichen, Institute of Computing
>     Technology, Chinese Academy of Sciences
> [...]
>
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

Applied to 2026.05.x, thanks !
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot