{"id":183658,"date":"2026-10-06T22:53:58","date_gmt":"2026-10-06T20:53:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/vypusk-openssh-10-6-s-ustraneniem-uyazvimostej"},"modified":"2026-10-06T22:54:02","modified_gmt":"2026-10-06T20:54:02","slug":"openssh-10-6-released-with-vulnerability-fixes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/openssh-10-6-released-with-vulnerability-fixes","title":{"rendered":"Vydanie OpenSSH 10.6 s odstr\u00e1nen\u00edm zranite\u013enost\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Vy\u0161la verzia OpenSSH 10.6, otvoren\u00e1 implement\u00e1cia klienta a servera na pr\u00e1cu s protokolmi SSH 2.0 a SFTP. Opraven\u00e9 bezpe\u010dnostn\u00e9 probl\u00e9my, z ktor\u00fdch v\u00e4\u010d\u0161ina bola odhalen\u00e1 anal\u00fdzou k\u00f3du pomocou AI n\u00e1strojov (CVE identifik\u00e1tory neboli pridelen\u00e9):  <\/p>\n<ul>\n<li class=\"l\"> Zranite\u013enos\u0165 v sftp, ktor\u00e1 umo\u017e\u0148uje zap\u00edsa\u0165 s\u00fabor mimo cie\u013eov\u00e9ho adres\u00e1ra pri pr\u00edstupe k serveru pod kontrolou \u00fato\u010dn\u00edka.\n<li class=\"l\"> Dvaja zranite\u013enosti v implement\u00e1cii GSSAPI v sshd, sp\u00f4soben\u00e9 uchov\u00e1van\u00edm stavu medzi r\u00f4znymi pokusmi o autentifik\u00e1ciu. \u00dadaje GSSAPI mohli by\u0165 uchov\u00e1van\u00e9 po ne\u00faspe\u0161nom pokuse o autentifik\u00e1ciu a pou\u017e\u00edvan\u00e9 po neskor\u0161om \u00faspe\u0161nom pokuse o autentifik\u00e1ciu. Probl\u00e9my sa prejavuj\u00fa pri aktivovanej mo\u017enosti GSSAPIAuthentication.\n<li class=\"l\"> V sshd a ssh bola zak\u00e1zan\u00e1 podpora kompresie LZ77 z d\u00f4vodu mo\u017enosti vykonania \u00fatoku prostredn\u00edctvom ved\u013eaj\u0161\u00edch kan\u00e1lov, ktor\u00fd by umo\u017enil obnovi\u0165 obsah z inej rel\u00e1cie pri pripojen\u00ed cez zdie\u013ean\u00e9 multiplexovan\u00e9 spojenie so \u017eiados\u0165ou, \u017ee kontrolovan\u00e9 vstupy od \u00fato\u010dn\u00edka ovplyv\u0148uj\u00fa celkov\u00fa d\u013a\u017eku pren\u00e1\u0161an\u00fdch \u0161ifrovan\u00fdch spr\u00e1v (LZ77 nahr\u00e1dza opakuj\u00face sa riadky odkazmi v spolo\u010dnej pam\u00e4ti pre v\u0161etky kan\u00e1ly).\n<li class=\"l\"> V n\u00e1stroji ssh je zak\u00e1z\u00e1no pou\u017e\u00edva\u0165 znaky &#8216;$&#8217; a &#8216;&#092;&#8217; v men\u00e1ch pou\u017e\u00edvate\u013eov zadan\u00fdch v pr\u00edkazovom riadku, preto\u017ee by to umo\u017enilo spustenie k\u00f3du prostredn\u00edctvom substit\u00facie mien v direkt\u00edvach ProxyCommand a Match exec, uveden\u00fdch v nastaveniach.\n<li class=\"l\"> V ssh-keygen bola opraven\u00e1 nespr\u00e1vna manipul\u00e1cia s letn\u00fdm \u010dasom, \u010do sp\u00f4sobilo posun platnosti certifik\u00e1tov o 1 hodinu.\n<li class=\"l\"> S cie\u013eom zablokova\u0165 vytv\u00e1ranie zip-bombiek bola v sshd a ssh pridan\u00e1 kontrola prekro\u010denia maxim\u00e1lnej ve\u013ekosti paketu pri rozba\u013eovan\u00ed \u00fadajov.\n<li class=\"l\"> V sshd bola vyrie\u0161en\u00e1 probl\u00e9m, ktor\u00fd umo\u017e\u0148oval ob\u00eds\u0165 obmedzenia k\u013e\u00fa\u010dov\u00e9ho slova &#171;restrict&#187; v s\u00fabore authorized_keys, ktor\u00e9 nebolo aplikovan\u00e9 na tunely (PermitTunnel).\n<li class=\"l\"> V sshd bol odstr\u00e1nen\u00fd nespr\u00e1vny parsing vo\u013eby &#171;none&#187; v blokoch Match, ktor\u00e1 bola v niektor\u00fdch direkt\u00edvach, ako AuthorizedPrincipalsFile, interpretovan\u00e1 ako n\u00e1zov s\u00faboru, a nie ako znak vypnutia direkt\u00edvy.\n<li class=\"l\"> V sshd bola odstr\u00e1nen\u00e1 absencia resetovania root-privil\u00e9gi\u00ed na platform\u00e1ch, ktor\u00e9 nepodporuj\u00fa prenos s\u00faborov\u00fdch deskriptorov a na ktor\u00e9 je potrebn\u00fd root pr\u00e1vo na alok\u00e1ciu PTY. Probl\u00e9m sa prejavuje na QNX 6, SCO OpenServer 5 a pri zostaven\u00ed s vo\u013ebou &#171;&#8212;disable-fd-passing&#187;.    <\/ul>\n<p>Zmeny, ktor\u00e9 nie s\u00fa spojen\u00e9 so zranite\u013enos\u0165ami:  <\/p>\n<ul>\n<li class=\"l\"> Podpora hybridn\u00e9ho kryptografick\u00e9ho algoritmu ssh-mldsa44-ed25519 je akt\u00edvna a odoln\u00e1 vo\u010di kvantov\u00fdm \u00fatokom.\n<li class=\"l\"> V sshd_config bola implementovan\u00e1 a predvolene aktivovan\u00e1 mo\u017enos\u0165 WarnWeakCrypto na riadenie v\u00fdstupu varovan\u00ed pri nadv\u00e4zovan\u00ed spojen\u00ed pomocou algoritmov v\u00fdmeny k\u013e\u00fa\u010dov, ktor\u00e9 s\u00fa n\u00e1chyln\u00e9 na kvantov\u00e9 \u00fatoky.\n<li class=\"l\"> V ssh-keygen a ssh-add bola implementovan\u00e1 kontrola politiky credProtect pre vykon\u00e1vanie overovac\u00edch po\u017eiadaviek (PIN alebo biometria) pred pr\u00edstupom k rezidentn\u00fdm k\u013e\u00fa\u010dom na FIDO tokenoch.\n<li class=\"l\"> V ssh-add bol pridan\u00fd flag &#171;-P&#187; na presko\u010denie volite\u013en\u00e9ho zadania PIN k\u00f3du pre tokeny FIDO a PKCS#11.\n<li class=\"l\"> V ssh bola v pr\u00edkaze ~I implementovan\u00e1 funkcia na zobrazovanie inform\u00e1ci\u00ed o verzi\u00e1ch na lok\u00e1lnych a vzdialen\u00fdch syst\u00e9moch.\n<li class=\"l\"> V sftp do pr\u00edkazov mkdir\/lmkdir bol pridan\u00fd flag &#8216;-p&#8217; na vytv\u00e1ranie adres\u00e1rov, ak je to potrebn\u00e9.\n<li class=\"l\"> V ssh-keygen bol pridan\u00fd re\u017eim &#171;hexdump&#187; na exportovanie k\u013e\u00fa\u010dov vo forme hexadecim\u00e1lnych dumpov (napr. na vlo\u017eenie do dokument\u00e1cie).\n<li class=\"l\"> V ssh a sshd v direkt\u00edve ChannelTimeout je mo\u017en\u00e9 \u0161pecifikova\u0165 \u010dasov\u00e9 limity s presnos\u0165ou na milisekundy.\n<li class=\"l\"> Do sshd bola pridan\u00e1 mo\u017enos\u0165 AgentSocketPath na ur\u010denie cesty k $SSH_AUTH_SOCK pri prenosoch agenta (napr\u00edklad user:.ssh\/agent pre podadres\u00e1re v $HOME a shared:\/tmp pre zdie\u013ean\u00e9 adres\u00e1re).\n<li class=\"l\"> V ssh-agent bol pridan\u00fd flag &#171;-A&#187; na ur\u010denie adres\u00e1rov so socketmi agenta, kde je povolen\u00e9 pou\u017eitie prefixov &#171;user:&#187; a &#171;shared:&#187; ako v mo\u017enosti AgentSocketPath.\n<li class=\"l\"> V sshd bola kontrola otvoren\u00fdch k\u013e\u00fa\u010dov oddelen\u00e1 od pokusov o autentifik\u00e1ciu. Bola pridan\u00e1 vo\u013eba &#171;PubkeyOptions max-pk-ok:nnnn&#187; na nastavenie po\u010dtu pokusov overenia otvoren\u00fdch k\u013e\u00fa\u010dov (predvolene 6), po ktor\u00fdch bude pripojenie preru\u0161en\u00e9 z d\u00f4vodu limitu MaxAuthTries.\n<li class=\"l\"> V ssh a sshd bola do vo\u013eby TCPKeepAlive pridan\u00e1 podpora hodnoty &#171;all&#187;, ktor\u00e1 zah\u0155\u0148a odosielanie keepalive paketov nielen pre prim\u00e1rne pripojenie, ale aj pre pripojenia, ktor\u00fdmi je tunelovan\u00e9.          <\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66410\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a OpenSSH 10.6, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0423\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u043f\u0440\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u043a\u043e\u0434\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c AI-\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 (CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043d\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u044b): \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 sftp, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0443. \u0414\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 GSSAPI [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183658","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a OpenSSH 10.6, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/news\/openssh-10-6-released-with-vulnerability-fixes\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a OpenSSH 10.6 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a OpenSSH 10.6, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/news\/openssh-10-6-released-with-vulnerability-fixes\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-06T20:53:58+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-06T20:54:02+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vydanie OpenSSH 10.6 so odstr\u00e1nen\u00edm zranite\u013enost\u00ed | ProHoster","description":"Bol vydan\u00fd OpenSSH 10.6, otvoren\u00e1 implement\u00e1cia klienta a servera na pr\u00e1cu s protokolmi SSH 2.0 a SFTP.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/openssh-10-6-released-with-vulnerability-fixes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a OpenSSH 10.6 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a OpenSSH 10.6, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/openssh-10-6-released-with-vulnerability-fixes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-06T20:53:58+00:00","article:modified_time":"2026-10-06T20:54:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/183658","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=183658"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/183658\/revisions"}],"predecessor-version":[{"id":183659,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/183658\/revisions\/183659"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=183658"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=183658"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=183658"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}