[Buildroot] [PATCH 1/1] package/openssh: security bump to version 10.5p1

[Buildroot] [PATCH 1/1] package/openssh: security bump to version 10.5p1

[Bernd Kuhls]

https://www.openssh.org/releasenotes.html#10.5p1

Changes since OpenSSH 10.4
==========================

This release contains a number of security fixes and small bugfixes.

Security
========

 * ssh-agent(1): fix an interaction between agent locking and the
   session-bind@openssh.com extension that is used to identify
   forwarded agents. These binding requests were refused when the
   agent was locked, with the result that operations that were
   intended to be limited to local use only could be performed
   remotely, including the ability to add PKCS#11 tokens and make
   use of keys that had destination restrictions applied.
   Reported by sn0x-sharma

 * ssh(1): avoid potential realloc use-after-free in the client if a
   remote forwarding is added via the local session multiplexing
   socket while a remote forwarding open request is pending with the
   server. Report and fix from Brian Mingus of Cognatory

 * sshd(8): make the authorized_keys "restrict" keyword apply
   correctly to tunnel forwarding too (which is administratively
   disabled by default). Reported by Erichen, Institute of Computing
   Technology, Chinese Academy of Sciences
[...]

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
Gitlab pipelines passed with all OpenSSL options disabled:
https://gitlab.com/bkuhls/buildroot/-/commits/04ce3d1ca73e5df02acdf7878b408faccdfd51e9

 package/openssh/openssh.hash | 4 ++--
 package/openssh/openssh.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/openssh/openssh.hash b/package/openssh/openssh.hash
index 297e1c95a1..aa84d011f8 100644
--- a/package/openssh/openssh.hash
+++ b/package/openssh/openssh.hash
@@ -1,4 +1,4 @@
-# From https://www.openssh.com/txt/release-10.4
-sha256  ef6026dd2aea8d56059638d5d3262902c892ceba9f88395835e0d06d3fb63238  openssh-10.4p1.tar.gz
+# From https://www.openssh.com/txt/release-10.5
+sha256  d44d28a839ea9daf969cc69150fde59910b2b39361dad81a3bd6cbd19218db11  openssh-10.5p1.tar.gz
 # Locally calculated
 sha256  5bb5b160726ef5756e4f32fe95b35249c294962419650f48d05134b486d27ccb  LICENCE
diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk
index 5575ba4f97..dd0a6e023e 100644
--- a/package/openssh/openssh.mk
+++ b/package/openssh/openssh.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-OPENSSH_VERSION_MAJOR = 10.4
+OPENSSH_VERSION_MAJOR = 10.5
 OPENSSH_VERSION_MINOR = p1
 OPENSSH_VERSION = $(OPENSSH_VERSION_MAJOR)$(OPENSSH_VERSION_MINOR)
 OPENSSH_CPE_ID_VERSION = $(OPENSSH_VERSION_MAJOR)
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/openssh: security bump to version 10.5p1

[Julien Olivain via buildroot]

On 16/08/2026 09:53, Bernd Kuhls wrote:
> https://www.openssh.org/releasenotes.html#10.5p1
> 
> Changes since OpenSSH 10.4
> ==========================
> 
> This release contains a number of security fixes and small bugfixes.
> 
> Security
> ========
> 
>  * ssh-agent(1): fix an interaction between agent locking and the
>    session-bind@openssh.com extension that is used to identify
>    forwarded agents. These binding requests were refused when the
>    agent was locked, with the result that operations that were
>    intended to be limited to local use only could be performed
>    remotely, including the ability to add PKCS#11 tokens and make
>    use of keys that had destination restrictions applied.
>    Reported by sn0x-sharma
> 
>  * ssh(1): avoid potential realloc use-after-free in the client if a
>    remote forwarding is added via the local session multiplexing
>    socket while a remote forwarding open request is pending with the
>    server. Report and fix from Brian Mingus of Cognatory
> 
>  * sshd(8): make the authorized_keys "restrict" keyword apply
>    correctly to tunnel forwarding too (which is administratively
>    disabled by default). Reported by Erichen, Institute of Computing
>    Technology, Chinese Academy of Sciences
> [...]
> 
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/openssh: security bump to version 10.5p1

[Titouan Christophe via buildroot]

On 16/08/26 09:53, Bernd Kuhls wrote:
> https://www.openssh.org/releasenotes.html#10.5p1
>
> Changes since OpenSSH 10.4
> ==========================
>
> This release contains a number of security fixes and small bugfixes.
>
> Security
> ========
>
>   * ssh-agent(1): fix an interaction between agent locking and the
>     session-bind@openssh.com extension that is used to identify
>     forwarded agents. These binding requests were refused when the
>     agent was locked, with the result that operations that were
>     intended to be limited to local use only could be performed
>     remotely, including the ability to add PKCS#11 tokens and make
>     use of keys that had destination restrictions applied.
>     Reported by sn0x-sharma
>
>   * ssh(1): avoid potential realloc use-after-free in the client if a
>     remote forwarding is added via the local session multiplexing
>     socket while a remote forwarding open request is pending with the
>     server. Report and fix from Brian Mingus of Cognatory
>
>   * sshd(8): make the authorized_keys "restrict" keyword apply
>     correctly to tunnel forwarding too (which is administratively
>     disabled by default). Reported by Erichen, Institute of Computing
>     Technology, Chinese Academy of Sciences
> [...]
>
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

Applied to 2026.05.x, thanks !
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot