{"id":183658,"date":"2026-10-06T22:53:58","date_gmt":"2026-10-06T20:53:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/vypusk-openssh-10-6-s-ustraneniem-uyazvimostej"},"modified":"2026-10-06T22:54:02","modified_gmt":"2026-10-06T20:54:02","slug":"openssh-10-6-released-with-vulnerability-fixes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/openssh-10-6-released-with-vulnerability-fixes","title":{"rendered":"L\u00ebshimi i OpenSSH 10.6 me korrigjimin e dob\u00ebsive","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Sapohet versioni OpenSSH 10.6, implementimi i hapur i klientit dhe serverit p\u00ebr funksionimin sipas protokolleve SSH 2.0 dhe SFTP. \u00cbsht\u00eb adresuar nj\u00eb num\u00ebr problemesh t\u00eb siguris\u00eb, shumica e t\u00eb cilave u identifikuan gjat\u00eb analiz\u00ebs s\u00eb kodit duke p\u00ebrdorur mjete AI (identifikuesit CVE nuk jan\u00eb caktuar): <\/p>\n
\n
Nj\u00eb cenueshm\u00ebri n\u00eb sftp, q\u00eb lejon q\u00eb t\u00eb shkruhet nj\u00eb skedar jasht\u00eb drejtoris\u00eb s\u00eb synuar kur lidhet me nj\u00eb server t\u00eb kontrolluar nga sulmuesit.\n
Dy cenueshm\u00ebri n\u00eb implementimin GSSAPI n\u00eb sshd, t\u00eb shkaktuara nga ruajtja e gjendjes midis p\u00ebrpjekjeve t\u00eb ndryshme p\u00ebr autentifikim. Kredencialet GSSAPI mund t\u00eb ruheshin pas nj\u00eb p\u00ebrpjekjeje t\u00eb d\u00ebshtuar p\u00ebr autentifikim dhe t\u00eb p\u00ebrdoren pas nj\u00eb p\u00ebrpjekjeje t\u00eb suksesshme p\u00ebr autentifikim. Probleme t\u00eb tilla manifestohen kur aktivizohet konfigurimi GSSAPIAuthentication.\n
N\u00eb sshd dhe ssh \u00ebsht\u00eb \u00e7aktivizuar mb\u00ebshtetja p\u00ebr kompresimin LZ77 p\u00ebr shkak t\u00eb mund\u00ebsis\u00eb p\u00ebr kryerjen e nj\u00eb sulmi p\u00ebrmes kanaleve an\u00ebsore, q\u00eb lejon rikuperimin e p\u00ebrmbajtjes nga nj\u00eb sesion tjet\u00ebr kur lidhet p\u00ebrmes nj\u00eb lidhjeje t\u00eb p\u00ebrbashk\u00ebt me viktim\u00ebn, duke p\u00ebrfituar nga fakti se t\u00eb dh\u00ebnat e kontrolluara nga sulmuesi ndikojn\u00eb n\u00eb gjat\u00ebsin\u00eb e p\u00ebrgjithshme t\u00eb mesazheve t\u00eb enkriptuara q\u00eb transmetohen (LZ77 z\u00ebvend\u00ebson rreshtat q\u00eb p\u00ebrs\u00ebriten me referenca n\u00eb nj\u00eb buffer t\u00eb p\u00ebrbashk\u00ebt p\u00ebr t\u00eb gjitha kanalet).\n
N\u00eb utilitarin ssh ndalohet p\u00ebrdorimi i simboleve '$' dhe '\' n\u00eb emrat e p\u00ebrdoruesve t\u00eb futur n\u00eb komand\u00ebn, p\u00ebr shkak se me to mund t\u00eb organizohet ekzekutimi i kodit gjat\u00eb z\u00ebvend\u00ebsimit t\u00eb emrave n\u00eb direktivat ProxyCommand dhe Match exec, t\u00eb specifikuara n\u00eb konfigurim.\n
Me q\u00ebllim bllokimin e krijimit t\u00eb zip-bombave n\u00eb sshd dhe ssh \u00ebsht\u00eb shtuar nj\u00eb kontroll n\u00eb tejkalimin e madh\u00ebsis\u00eb maksimale t\u00eb paket\u00ebs gjat\u00eb shp\u00ebrndarjes s\u00eb t\u00eb dh\u00ebnave.\n
N\u00eb sshd \u00ebsht\u00eb zgjidhur nj\u00eb problem q\u00eb lejonte kalimin e kufizimeve t\u00eb fjal\u00ebs ky\u00e7e \u00abrestrict\u00bb n\u00eb skedarin authorized_keys, q\u00eb nuk kishte efekt n\u00eb tunelet (PermitTunnel).\n
N\u00eb sshd \u00ebsht\u00eb eliminuar nj\u00eb analiz\u00eb e pasakt\u00eb e opsionit \u00abnone\u00bb brenda bllokave Match, i cili n\u00eb disa drejtime, si AuthorizedPrincipalsFile, interpretohej si emri i skedarit, dhe jo si nj\u00eb shenj\u00eb p\u00ebr \u00e7aktivizimin e direktiv\u00ebs.\n
N\u00eb sshd \u00ebsht\u00eb eliminuar mungesa e rikthimit t\u00eb privilegjeve root n\u00eb platformat q\u00eb nuk mb\u00ebshtesin transferimin e descriptor\u00ebve t\u00eb skedar\u00ebve dhe k\u00ebrkojn\u00eb p\u00ebr ndarjen e PTY drejtues root. Problemi shfaqet n\u00eb QNX 6, SCO OpenServer 5 dhe kur ndodh nd\u00ebrtimi me opsionin \u00ab--disable-fd-passing\u00bb. <\/ul>\n
Ndryshime t\u00eb pa lidhura me vulnerabilitetet: <\/p>\n
\n
Mb\u00ebshtetje e aktivizuar p\u00ebr algoritmin hibrid t\u00eb kriptimit ssh-mldsa44-ed25519, i q\u00ebndruesh\u00ebm ndaj thyerjes nga kompjuter\u00ebt kuantik\u00eb.\n
N\u00eb sshd_config \u00ebsht\u00eb implementuar dhe aktivizuar si parazgjedhje opsioni WarnWeakCrypto p\u00ebr t\u00eb menaxhuar daljen e paralajm\u00ebrimeve mbi lidhjet e krijuara me algoritme t\u00eb negociat\u00ebs s\u00eb \u00e7el\u00ebsit, t\u00eb cilat nuk jan\u00eb t\u00eb q\u00ebndrueshme ndaj thyerjes nga kompjuter\u00ebt kuantik\u00eb.\n
N\u00eb ssh-keygen dhe ssh-add \u00ebsht\u00eb realizuar kontrolli i politik\u00ebs credProtect n\u00eb kredencialet p\u00ebr t\u00eb p\u00ebrmbushur k\u00ebrkesat e verifikimit (PIN ose biometrik\u00eb) para qasjes n\u00eb \u00e7el\u00ebsat rezidencial\u00eb n\u00eb tokenat FIDO.\n
N\u00eb ssh-add \u00ebsht\u00eb shtuar flaga \u00ab-P\u00bb p\u00ebr t\u00eb kaluar hyrjen e mundshme t\u00eb PIN-it p\u00ebr tokenet FIDO dhe PKCS#11.\n
N\u00eb ssh komanda ~I \u00ebsht\u00eb implementuar nxjerrja e informacionit mbi versionet n\u00eb sistemet lokale dhe t\u00eb larg\u00ebta.\n
N\u00eb sftp n\u00eb komandat mkdir\/lmkdir \u00ebsht\u00eb shtuar flaga '-p' p\u00ebr t\u00eb krijuar direktori n\u00ebse \u00ebsht\u00eb e nevojshme.\n
N\u00eb ssh-keygen \u00ebsht\u00eb shtuar moda \u00abhexdump\u00bb p\u00ebr eksportimin e \u00e7el\u00ebsave n\u00eb form\u00ebn e dump-ve n\u00eb hexadecimal (p\u00ebr shembull, p\u00ebr t'u ngjitur n\u00eb dokumentacion).\n
N\u00eb ssh dhe sshd n\u00eb direktiv\u00ebn ChannelTimeout lejohet caktimi i koh\u00ebve t\u00eb pritjes me sakt\u00ebsi deri n\u00eb pjes\u00ebt e sekond\u00ebs.\n
N\u00eb ssh-agent \u00ebsht\u00eb shtuar flaga \u00ab-A\u00bb p\u00ebr t\u00eb specifikuar katalog\u00ebt me socket-et e agjentit, ku lejohet specifikimi i prefikseve \u00abuser:\u00bb dhe \u00abshared:\u00bb si n\u00eb opsionin AgentSocketPath.\n
N\u00eb sshd kontrolli i \u00e7el\u00ebsave publik \u00ebsht\u00eb ndar\u00eb nga p\u00ebrpjekjet e autentifikimit. \u00cbsht\u00eb shtuar opsioni \u00abPubkeyOptions max-pk-ok:nnnn\u00bb p\u00ebr t\u00eb konfiguruar numrin e p\u00ebrpjekjeve p\u00ebr kontrollin e \u00e7el\u00ebsave publik\u00eb (n\u00eb m\u00ebnyr\u00eb default 6), pas t\u00eb cilave lidhja do t\u00eb nd\u00ebrpritet p\u00ebr shkak t\u00eb limitit MaxAuthTries.\n
N\u00eb ssh dhe sshd n\u00eb opsionin TCPKeepAlive \u00ebsht\u00eb shtuar mb\u00ebshtetje p\u00ebr vler\u00ebn \u00aball\u00bb, e cila p\u00ebrfshin d\u00ebrgimin e pakove keepalive jo vet\u00ebm p\u00ebr lidhjen kryesore, por edhe p\u00ebr lidhjet e kaluara p\u00ebrmes saj. <\/ul>\n