{"id":183658,"date":"2026-10-06T22:53:58","date_gmt":"2026-10-06T20:53:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/vypusk-openssh-10-6-s-ustraneniem-uyazvimostej"},"modified":"2026-10-06T22:54:02","modified_gmt":"2026-10-06T20:54:02","slug":"openssh-10-6-released-with-vulnerability-fixes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/openssh-10-6-released-with-vulnerability-fixes","title":{"rendered":"OpenSSH 10.6 izlaidums ar dro\u0161\u012bbas ievainojam\u012bbu nov\u0113r\u0161anu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Public\u0113ts OpenSSH 10.6 izlaidums \u2014 atv\u0113rt\u0101s realiz\u0101cijas klients un serveris SSH 2.0 un SFTP protokolu darb\u012bbai. Nov\u0113rstas dro\u0161\u012bbas probl\u0113mas, no kur\u0101m liel\u0101ko da\u013cu atkl\u0101ja, analiz\u0113jot kodu, izmantojot AI r\u012bkus (CVE identifikatori nav pie\u0161\u0137irti):  <\/p>\n<ul>\n<li class=\"l\"> Vainojam\u012bba sftp, kas \u013cauj uzrakst\u012bt failu \u0101rpus m\u0113r\u0137direktorijas, piesl\u0113dzoties serverim, ko kontrol\u0113 uzbruc\u0113ji.\n<li class=\"l\"> Divas GSSAPI realiz\u0101cijas ievainojam\u012bbas sshd, ko izrais\u012bja st\u0101vok\u013ca saglab\u0101\u0161ana starp da\u017e\u0101diem autentifik\u0101cijas m\u0113\u0123in\u0101jumiem. GSSAPI akredit\u012bvi var\u0113ja palikt akt\u012bvi p\u0113c neveiksm\u012bgas autentifik\u0101cijas m\u0113\u0123in\u0101juma un tikt izmantoti p\u0113c turpm\u0101k veiksm\u012bgas autentifik\u0101cijas. Probl\u0113mas izpau\u017eas, iesl\u0113dzot GSSAPIAuthentication iestat\u012bjumu.\n<li class=\"l\"> LZ77 saspie\u0161anas atbalsts sshd un ssh ir atsl\u0113gts, jo past\u0101v iesp\u0113ja \u012bstenot uzbrukumu caur blakus kan\u0101lu, \u013caujot atjaunot saturu no cita sesijas, savienojoties kop\u012bg\u0101 ar upuri multiplex\u0113t\u0101 savienojum\u0101, izmantojot to, ka uzbruc\u0113ja kontrol\u0113ti dati ietekm\u0113 kop\u0113jo nos\u016bt\u012bto \u0161ifr\u0113to zi\u0146ojumu garumu (LZ77 aizvieto atk\u0101rtotas virknes ar atsauc\u0113m kop\u0113j\u0101 bufer\u012b, kas ir pieejams visiem kan\u0101liem).\n<li class=\"l\"> SSH utilit\u0101t\u0113 aizliegts izmantot simbolus \u2018$\u2019 un \u2018\n\u2019 lietot\u0101ju v\u0101rdos, kas ievad\u012bti komand\u0101m, jo \u200b\u200bt\u0101d\u0101 veid\u0101 iesp\u0113jams veidot koda izpildi, ievietojot v\u0101rdus direkt\u012bv\u0101s ProxyCommand un Match exec, kas nor\u0101d\u012btas iestat\u012bjumos.\n<li class=\"l\"> ssh-keygen ir nov\u0113rsta nepareiza vasaras laika apstr\u0101de, kas izrais\u012bja sertifik\u0101tu der\u012bguma termi\u0146a novirzi par 1 stundu.\n<li class=\"l\"> Ar m\u0113r\u0137i blo\u0137\u0113t zip-bumbu veido\u0161anu sshd un ssh ir pievienota p\u0101rbaude par maksim\u0101l\u0101 paketes izm\u0113ra p\u0101rsnieg\u0161anu, izpakojot datus.\n<li class=\"l\"> SSHd ir atrisin\u0101ta probl\u0113ma, kas \u013c\u0101va apiet ierobe\u017eojumus atsl\u0113gv\u0101rda \u00abrestrict\u00bb izmanto\u0161anai authorized_keys fail\u0101, kas netika piem\u0113rots tunel\u0113\u0161anai (PermitTunnel).\n<li class=\"l\"> SSHd ir nov\u0113rsta nepareiza opcijas \u00abnone\u00bb anal\u012bze Match blokos, kas da\u017e\u0101s direkt\u012bv\u0101s, piem\u0113ram, AuthorizedPrincipalsFile, tika interpret\u0113ta k\u0101 faila nosaukums, nevis k\u0101 direkt\u012bvas atsl\u0113g\u0161anas r\u0101d\u012bt\u0101js.\n<li class=\"l\"> SSHd ir nov\u0113rsta root privil\u0113\u0123iju atteik\u0161an\u0101s tr\u016bkums platform\u0101s, kas neatbalsta failu descriptoru p\u0101rs\u016bt\u012b\u0161anu un prasa root ties\u012bbas PTY pie\u0161\u0137ir\u0161anai. Probl\u0113ma izpau\u017eas QNX 6, SCO OpenServer 5 un kad tas tiek b\u016bv\u0113ts ar opciju \u00ab--disable-fd-passing\u00bb.    <\/ul>\n<p>Nav saist\u012btie ar ievainojam\u012bb\u0101m izmai\u0146as:  <\/p>\n<ul>\n<li class=\"l\"> Iek\u013cauta hibr\u012bda kriptogr\u0101fisk\u0101 algoritma ssh-mldsa44-ed25519 atbalsts, kas ir iztur\u012bgs pret uzbrukumiem ar kvantu datoriem.\n<li class=\"l\"> sshd_config ir ieviesta un p\u0113c noklus\u0113juma iesl\u0113gta opcija WarnWeakCrypto, lai p\u0101rvald\u012btu br\u012bdin\u0101jumu par savienojumu, izmantojot atsl\u0113gu saska\u0146o\u0161anas algoritmus, kas nav iztur\u012bgi pret uzbrukumiem ar kvantu datoriem.\n<li class=\"l\"> ssh-keygen un ssh-add ir ieviesta credProtect politikas p\u0101rbaude v\u0113rt\u012bb\u0101s, lai izpild\u012btu verifik\u0101cijas pras\u012bbas (PIN vai biometrika) pirms piek\u013cuves rezidentajiem atsl\u0113g\u0101m FIDO t\u012bklos.\n<li class=\"l\"> SSH-add ir pievienots karogs \u00ab-P\u00bb, lai izlaistu opcionalo pin-koda ievadi FIDO un PKCS#11 \u017eetoniem.\n<li class=\"l\"> ssh komand\u0101 ~I ir ieviesta inform\u0101cijas par versij\u0101m izdruka lok\u0101laj\u0101s un att\u0101laj\u0101s sist\u0113m\u0101s.\n<li class=\"l\"> SFTP komand\u0101m mkdir\/lmkdir ir pievienots karogs \u2018-p\u2019, lai nepiecie\u0161am\u012bbas gad\u012bjum\u0101 izveidotu direktorijas.\n<li class=\"l\"> SSH-keygen ir pievienots \u2018hexdump\u2019 re\u017e\u012bms, lai eksport\u0113tu atsl\u0113gas heksadecim\u0101lajos dump\u0113jumos (piem\u0113ram, dokument\u0101cijai).\n<li class=\"l\"> ssh un sshd direkt\u012bv\u0101 ChannelTimeout ir at\u013cauts nor\u0101d\u012bt laika ierobe\u017eojumus ar precizit\u0101ti l\u012bdz sekundes da\u013c\u0101m.\n<li class=\"l\"> sshd ir pievienota opcija AgentSocketPath, lai nor\u0101d\u012btu ce\u013cu uz $SSH_AUTH_SOCK a\u0123enta p\u0101rs\u016bt\u012b\u0161anai (piem\u0113ram, user:.ssh\/agent apak\u0161katalogiem $HOME un shared:\/tmp koplieto\u0161anas katalogiem).\n<li class=\"l\"> SSH-agent ir pievienots karogs \u2018-A\u2019, lai nor\u0101d\u012btu a\u0123enta soketu katalogus, kuros ir at\u013cauti prefiksi \u00abuser:\u00bb un \u00abshared:\u00bb, t\u0101pat k\u0101 opcij\u0101 AgentSocketPath.\n<li class=\"l\"> SSHd atsl\u0113gu p\u0101rbaude ir nodal\u012bta no autentifik\u0101cijas m\u0113\u0123in\u0101jumiem. Pievienota opcija \u2018PubkeyOptions max-pk-ok:nnnn\u2019, lai konfigur\u0113tu atsl\u0113gu p\u0101rbaudes m\u0113\u0123in\u0101jumu skaitu (noklus\u0113jum\u0101 6), p\u0113c kura savienojums tiks p\u0101rtraukts saska\u0146\u0101 ar MaxAuthTries limitu.\n<li class=\"l\"> SSH un SSHd opcij\u0101 TCPKeepAlive ir pievienota atbalsta v\u0113rt\u012bba \u2018all\u2019, kas ietver keepalive paketes s\u016bt\u012b\u0161anu ne tikai galvenajam savienojumam, bet ar\u012b tam caursp\u012bd\u012bgiem savienojumiem.          <\/ul>\n<p>Avots: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66410\">opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a OpenSSH 10.6, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0423\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u043f\u0440\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u043a\u043e\u0434\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c AI-\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 (CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043d\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u044b): \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 sftp, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0443. \u0414\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 GSSAPI [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183658","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a OpenSSH 10.6, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/lv\/blog\/news\/openssh-10-6-released-with-vulnerability-fixes\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"lv_LV\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a OpenSSH 10.6 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a OpenSSH 10.6, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/lv\/blog\/news\/openssh-10-6-released-with-vulnerability-fixes\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-06T20:53:58+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-06T20:54:02+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenSSH 10.6 versija ar dro\u0161\u012bbas ievainojumu nov\u0113r\u0161anu | ProHoster","description":"Public\u0113ta OpenSSH 10.6 versija, atv\u0113rta klienta un servera \u012bsteno\u0161ana darb\u012bbai ar SSH 2.0 un SFTP protokoliem.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/openssh-10-6-released-with-vulnerability-fixes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a OpenSSH 10.6 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a OpenSSH 10.6, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/openssh-10-6-released-with-vulnerability-fixes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-06T20:53:58+00:00","article:modified_time":"2026-10-06T20:54:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/183658","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=183658"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/183658\/revisions"}],"predecessor-version":[{"id":183659,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/183658\/revisions\/183659"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=183658"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=183658"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=183658"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}