[Buildroot] [PATCH 1/1] package/openssh: security bump to version 10.4p1

[Buildroot] [PATCH 1/1] package/openssh: security bump to version 10.4p1

[Bernd Kuhls]

https://www.openssh.org/releasenotes.html#10.4p1

Changes since OpenSSH 10.3
==========================

This release contains a number of security fixes as well as general
bugfixes and a couple of new features.

Security
========

 * sftp(1): when downloading files on the command-line using
   "sftp host:/path .", a malicious server could cause the file to
   be downloaded to an unexpected location. This issue was identified
   by the Swival Security Scanner.

 * scp(1): when copying files between two remote destinations, do
   not allow a malicious server to write files to the parent
   directory of the intended target directory.  This issue was
   identified by the Swival Security Scanner.

 * sshd(8): when using the "internal-sftp" SFTP server implementation
   (this is not the default), long command lines were previously
   truncated silently after the 9th argument. If a security-relevant
   option was in the 10th or later position, it would be discarded.
   Reported by Steve Caffrey.

 * sshd(8): add a documentation note to mention that the
   GSSAPIStrictAcceptorCheck option is ineffective when the server
   is joined to a Windows Active Directory. Reported by Yarin Aharoni
   of Safebreach.

 * sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes
   as it was documented to do. Note that PermitTunnel is not enabled
   by default. Reported independently by Huzaifa Sidhpurwala of
   Redhat and Marko Jevtic.

 * sshd(8): avoid a potential pre-authentication denial of service
   when GSSAPIAuthentication was enabled (this feature is off by
   default). This was not mitigated by MaxAuthTries, but would be
   penalised by PerSourcePenalties. This was reported by Manfred
   Kaiser of the milCERT AT (Austrian Ministry of Defence).

 * sshd(8): fix a number of cases where the minimum authentication
   delay was not being enforced. Reported by the Orange Cyberdefense
   Vulnerability Team.

 * ssh(1): fix a possible client-side use-after-free if the server
   changes its host key during a key reexchange. This was reported by
   Zhenpeng (Leo) Lin of Depthfirst.
[...]

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
Gitlab pipelines show no new errors introduced by this bump:
https://gitlab.com/bkuhls/buildroot/-/commits/1a2823463ec674dc95d73cb0469e49ab218912fe

bootlin-powerpc64le-power8-glibc which was broken before:
https://autobuild.buildroot.net/results/507/507cb5458e29499ad1ab0f07b2401dd707954c2d/

 package/openssh/openssh.hash | 4 ++--
 package/openssh/openssh.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/openssh/openssh.hash b/package/openssh/openssh.hash
index 2d242b4a99..297e1c95a1 100644
--- a/package/openssh/openssh.hash
+++ b/package/openssh/openssh.hash
@@ -1,4 +1,4 @@
-# From https://www.openssh.com/txt/release-10.3
-sha256  56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4  openssh-10.3p1.tar.gz
+# From https://www.openssh.com/txt/release-10.4
+sha256  ef6026dd2aea8d56059638d5d3262902c892ceba9f88395835e0d06d3fb63238  openssh-10.4p1.tar.gz
 # Locally calculated
 sha256  5bb5b160726ef5756e4f32fe95b35249c294962419650f48d05134b486d27ccb  LICENCE
diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk
index 8f46d886dc..2f3088defe 100644
--- a/package/openssh/openssh.mk
+++ b/package/openssh/openssh.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-OPENSSH_VERSION_MAJOR = 10.3
+OPENSSH_VERSION_MAJOR = 10.4
 OPENSSH_VERSION_MINOR = p1
 OPENSSH_VERSION = $(OPENSSH_VERSION_MAJOR)$(OPENSSH_VERSION_MINOR)
 OPENSSH_CPE_ID_VERSION = $(OPENSSH_VERSION_MAJOR)
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/openssh: security bump to version 10.4p1

[Julien Olivain via buildroot]

On 06/07/2026 19:33, Bernd Kuhls wrote:
> https://www.openssh.org/releasenotes.html#10.4p1
> 
> Changes since OpenSSH 10.3
> ==========================
> 
> This release contains a number of security fixes as well as general
> bugfixes and a couple of new features.
> 
> Security
> ========
> 
>  * sftp(1): when downloading files on the command-line using
>    "sftp host:/path .", a malicious server could cause the file to
>    be downloaded to an unexpected location. This issue was identified
>    by the Swival Security Scanner.
> 
>  * scp(1): when copying files between two remote destinations, do
>    not allow a malicious server to write files to the parent
>    directory of the intended target directory.  This issue was
>    identified by the Swival Security Scanner.
> 
>  * sshd(8): when using the "internal-sftp" SFTP server implementation
>    (this is not the default), long command lines were previously
>    truncated silently after the 9th argument. If a security-relevant
>    option was in the 10th or later position, it would be discarded.
>    Reported by Steve Caffrey.
> 
>  * sshd(8): add a documentation note to mention that the
>    GSSAPIStrictAcceptorCheck option is ineffective when the server
>    is joined to a Windows Active Directory. Reported by Yarin Aharoni
>    of Safebreach.
> 
>  * sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes
>    as it was documented to do. Note that PermitTunnel is not enabled
>    by default. Reported independently by Huzaifa Sidhpurwala of
>    Redhat and Marko Jevtic.
> 
>  * sshd(8): avoid a potential pre-authentication denial of service
>    when GSSAPIAuthentication was enabled (this feature is off by
>    default). This was not mitigated by MaxAuthTries, but would be
>    penalised by PerSourcePenalties. This was reported by Manfred
>    Kaiser of the milCERT AT (Austrian Ministry of Defence).
> 
>  * sshd(8): fix a number of cases where the minimum authentication
>    delay was not being enforced. Reported by the Orange Cyberdefense
>    Vulnerability Team.
> 
>  * ssh(1): fix a possible client-side use-after-free if the server
>    changes its host key during a key reexchange. This was reported by
>    Zhenpeng (Leo) Lin of Depthfirst.
> [...]
> 
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot