{"id":112310,"date":"2023-12-19T03:10:31","date_gmt":"2023-12-19T01:10:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-9-6-c-ustraneniem-uyazvimostej"},"modified":"2023-12-19T03:10:31","modified_gmt":"2023-12-19T01:10:31","slug":"reliz-openssh-9-6-c-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/reliz-openssh-9-6-c-ustraneniem-uyazvimostej","title":{"rendered":"Release of OpenSSH 9.6 with vulnerability fixes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The release of OpenSSH 9.6 has been published, an open-source implementation of the client and server for SSH 2.0 and SFTP protocols. This new version addresses three security issues: <\/p>\n
\n
A vulnerability in the SSH protocol (CVE-2023-48795, the 'Terrapin' attack) allows an attacker to roll back the connection during a MITM (Man-in-the-Middle) attack to use less secure authentication algorithms and disable protection against attacks via external channels, which recreate input by analyzing the delays between key presses on the keyboard. The method of attack is outlined in a separate news article.\n
A vulnerability in the ssh utility allows arbitrary shell command substitution through manipulation of login and host values containing special characters. This vulnerability can be exploited if the attacker controls the values of the username and hostname passed to ssh, the ProxyCommand and LocalCommand directives, or 'match exec' blocks that specify substitution characters like %u and %h. For instance, incorrect username and host can be substituted in systems using Git submodules, as Git does not prohibit special characters in the hostname and username. A similar vulnerability also manifests in libssh.\n
An error in ssh-agent, which caused restrictions to apply only to the first key returned by the PKCS#11 token when adding private keys. This issue does not affect regular private keys, FIDO tokens, or keys specified without restrictions. <\/ul>\n
Other changes: <\/p>\n
\n
A '%j' substitution has been added to ssh, which expands to the hostname specified by the ProxyJump directive.\n
Support has been added in ssh for configuring ChannelTimeout on the client side, which can be used to terminate inactive channels.\n
Support for reading ED25519 private keys in PEM PKCS8 format has been added to ssh, sshd, ssh-add, and ssh-keygen (previously, only OpenSSH format was supported).\n
An extension to the protocol has been added to ssh and sshd for renegotiating signature algorithms for public key authentication, occurring after the username data is received. For example, the extension can selectively use different algorithms tied to users by specifying PubkeyAcceptedAlgorithms in the 'Match user' block.\n
In ssh-add and ssh-agent, a protocol extension has been added for specifying certificates when loading PKCS#11 keys, enabling the use of certificates associated with PKCS#11 private keys in all OpenSSH utilities that support ssh-agent, not just in ssh.\n
Enhanced detection of unsupported or unstable compiler flags, such as '-fzero-call-used-regs' in clang.\n
To limit the privileges of the sshd process in OpenSolaris versions supporting the getpflags() interface, the PRIV_XPOLICY mode has been engaged instead of PRIV_LIMIT. <\/ul>\n