Project

General

Profile

Actions
Copy link

Bug #3403

open
« Previous | 2 of 493 | Next »

update crypto/openssh to 10.0

Added by pmjdebruijn about 4 hours ago. Updated about 4 hours ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
-
Target version:
6.6
Start date:
02/24/2026
Due date:
% Done:

0%

Estimated time:

Description

It seems OpenSSH 10.0 and further are free of vulnerabilities (though I'm not sure what specifically applies to DragonFly):

https://www.openssh.org/security.html

Sticking to 10.0 (and not further) may be beneficial, as it would allow you to pull backported security fixes from (for example) Debian Trixie, which could easy maintenance load...

Actions
Copy link
 #1

Updated by pmjdebruijn about 4 hours ago

Currently OpenSSH 9.8 seems to be missing at least:

CVE-2025-26465.patch
fix-disable-forwarding.patch

http://deb.debian.org/debian/pool/main/o/openssh/openssh_9.2p1-2+deb12u7.debian.tar.xz

OpenSSH 9.1 in DF6.4 is probably missing more, so it probably makes sense to backport 9.8 to DF6.4 with the patches above.

Actions
Copy link

Also available in: Atom PDF