The release of OpenSSH 9.3 has been published, an open implementation of the client and server for SSH 2.0 and SFTP protocols. The new version addresses security issues: <\/p>\n
\n
A logical error has been identified in the ssh-add utility, which prevents restrictions specified with the \u2018ssh-add -h\u2019 option from being passed to the ssh-agent when adding smart card keys. As a result, a key was added to the agent without applying restrictions that allow connections only from certain hosts.\n
A vulnerability has been found in the ssh utility that may lead to reading data from the stack outside the allocated buffer when processing specially crafted DNS responses, if the VerifyHostKeyDNS setting is enabled in the configuration file. This issue exists in the built-in implementation of the getrrsetbyname() function, which is used in portable versions of OpenSSH compiled without the external ldns library (\u2014with-ldns) and on systems with standard libraries that do not support the getrrsetbyname() call. The likelihood of exploiting this vulnerability, apart from initiating a denial of service for the ssh client, is considered low. <\/ul>\n
Additionally, a vulnerability in the libskey library included in OpenBSD, which is used in OpenSSH, has been noted. This issue has been present since 1997 and may lead to a stack buffer overflow when processing specially crafted hostnames. It is noted that although this vulnerability can be triggered remotely via OpenSSH, it is practically useless, as the attacked hostname (\/etc\/hostname) must contain more than 126 characters, and the buffer can only be overflowed with null characters (\u2019\u2019). <\/p>\n
Among the non-security-related changes: <\/p>\n
\n
Support for the parameter \u2018-Ohashalg=sha1|sha256\u2019 has been added to ssh-keygen and ssh-keyscan for selecting the hash algorithm for SSHFP fingerprints.\n
An option \u2018-G\u2019 has been added to sshd for parsing and displaying the active configuration without attempting to load private keys and without performing additional checks, allowing verification of the configuration at the stage prior to key generation and enabling checks by unprivileged users.\n
In sshd, isolation has been strengthened on the Linux platform using system call filtering mechanisms seccomp and seccomp-bpf. Flags for mmap, madvise, and futex have been added to the list of allowed system calls. <\/ul>\n