{"id":103424,"date":"2022-02-24T15:36:49","date_gmt":"2022-02-24T13:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd"},"modified":"2022-02-24T15:36:49","modified_gmt":"2022-02-24T13:36:49","slug":"reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd","title":{"rendered":"Release av OpenSSH 8.9 med \u00e5tg\u00e4rd f\u00f6r s\u00e5rbarhet i sshd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Efter sex m\u00e5naders utveckling har OpenSSH 8.9, en \u00f6ppen implementation av klient och server f\u00f6r att arbeta med SSH 2.0 och SFTP-protokollen, sl\u00e4ppts. I den nya versionen har en s\u00e5rbarhet i sshd \u00e5tg\u00e4rdats, vilket potentiellt skulle kunna ge access utan autentisering. Problemet orsakas av ett heltalsoverflows i autentiseringskoden, men utnyttjande \u00e4r endast m\u00f6jligt i kombination med andra logiska fel i koden.    <\/p>\n<p> I sin nuvarande form \u00e4r s\u00e5rbarheten inte utnyttjbar n\u00e4r privilegiedelning \u00e4r aktiverat, eftersom dess manifestation blockeras av separata kontroller som utf\u00f6rs i koden f\u00f6r privilegiedelning. Privilegiedelningsl\u00e4get aktiverades som standard 2002, med OpenSSH 3.2.2, och har varit obligatoriskt sedan lanseringen av OpenSSH 7.5, som publicerades 2017. Dessutom blockeras s\u00e5rbarheten i b\u00e4rbara versioner av OpenSSH som b\u00f6rjar med version 6.5 (2014) genom kompilering med inkluderade flaggor f\u00f6r skydd mot heltalsoverflows.       <\/p>\n<p>Andra f\u00f6r\u00e4ndringar:  <\/p>\n<ul>\n<li class=\"l\"> I den b\u00e4rbara versionen av OpenSSH har inbyggt st\u00f6d f\u00f6r hashning av l\u00f6senord med hj\u00e4lp av MD5-algoritmen tagits bort (koppling till externa bibliotek, s\u00e5som libxcrypt, \u00e4r till\u00e5ten f\u00f6r \u00e5tkomst).\n<li class=\"l\"> I ssh, sshd, ssh-add och ssh-agent har en delsystem implementerats f\u00f6r att begr\u00e4nsa \u00f6verf\u00f6ring och anv\u00e4ndning av nycklar som lagts till i ssh-agent. Delsystemet till\u00e5ter att specificera regler som definierar hur och var nycklar f\u00e5r anv\u00e4ndas i ssh-agent. Till exempel, f\u00f6r att l\u00e4gga till en nyckel som endast kan anv\u00e4ndas f\u00f6r autentisering n\u00e4r n\u00e5gon anv\u00e4ndare ansluter till v\u00e4rden scylla.example.org, anv\u00e4ndaren perseus till v\u00e4rden cetus.example.org och anv\u00e4ndaren medea till v\u00e4rden charybdis.example.org med omdirigering genom den mellanliggande v\u00e4rden scylla.example.org, kan f\u00f6ljande kommando anv\u00e4ndas: $ ssh-add -h \u00abperseus@cetus.example.org\u00bb \n -h \u00abscylla.example.org\u00bb \n -h \u00abscylla.example.org&gt;medea@charybdis.example.org\u00bb \n ~\/ .ssh\/id_ed25519\n<li class=\"l\"> I ssh och sshd har den hybridalgoritm \u00absntrup761x25519-sha512@openssh.com\u00bb (ECDH\/x25519 + NTRU Prime), som \u00e4r motst\u00e5ndskraftig mot brute-force attacker p\u00e5 kvantdatorer, lagts till i listan KexAlgorithms, som definierar ordningen f\u00f6r valet av metod f\u00f6r nyckelutbyte, som standard. I version OpenSSH 8.9 har denna f\u00f6rhandlingsmetod lagts till mellan metoderna ECDH och DH, men i n\u00e4sta utg\u00e5va planerar de att anv\u00e4nda den som standard.\n<li class=\"l\"> I ssh-keygen, ssh och ssh-agent har hanteringen av FIDO-tokennycklar f\u00f6rb\u00e4ttrats, vilket anv\u00e4nds f\u00f6r enhetsverifikation, inklusive nycklar f\u00f6r biometrisk autentisering.\n<li class=\"l\"> I ssh-keygen har kommandot \u00abssh-keygen -Y match-principals\u00bb lagts till f\u00f6r att kontrollera anv\u00e4ndarnamn i filen med till\u00e5tna namn.\n<li class=\"l\"> I ssh-add och ssh-agent har m\u00f6jligheten att l\u00e4gga till PIN-skyddade FIDO-nycklar i ssh-agenten inf\u00f6rts (PIN-beg\u00e4ran visas vid autentisering).\n<li class=\"l\"> I ssh-keygen till\u00e5ts valet av hash-algoritm (sha512 eller sha256) under signering.\n<li class=\"l\"> I ssh och sshd l\u00e4ses n\u00e4tverksdata direkt till bufferten f\u00f6r inkommande paket f\u00f6r att \u00f6ka prestandan, vilket omg\u00e5r mellanliggande buffring i stacken. P\u00e5 liknande s\u00e4tt implementerades direkt ins\u00e4ttning av mottagna data i kanalbufferten.\n<li class=\"l\"> I ssh har direktivet PubkeyAuthentication utvidgats med en lista \u00f6ver st\u00f6dda parametrar (yes|no|unbound|host-bound) f\u00f6r att ge m\u00f6jlighet att v\u00e4lja vilken variant av det anv\u00e4nda protokollet som ska anv\u00e4ndas.      <\/ul>\n<p>I en av kommande versioner planeras det att som standard \u00f6verf\u00f6ra verktyget scp till anv\u00e4ndning av SFTP ist\u00e4llet f\u00f6r det f\u00f6r\u00e5ldrade protokollet SCP\/RCP. SFTP anv\u00e4nder mer f\u00f6ruts\u00e4gbara metoder f\u00f6r hantering av namn och g\u00f6r inte anv\u00e4ndning av glob-m\u00f6nsterbehandling i filnamn genom shell p\u00e5 den andra v\u00e4rden, vilket skapar s\u00e4kerhetsproblem. Specifikt, vid anv\u00e4ndning av SCP och RCP beslutar servern vilka filer och kataloger som ska skickas till klienten, och klienten kontrollerar endast om de returnerade objektnamnen \u00e4r korrekta, vilket i avsaknad av tillr\u00e4ckliga kontroller p\u00e5 klientsidan kan leda till att <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sv\/server\/dts-shicago\/\"   title=\"servern\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2906\">servern<\/a> att \u00f6verf\u00f6ra andra filnamn som skiljer sig fr\u00e5n de beg\u00e4rda. SFTP-protokollet saknar de angivna problemen men st\u00f6der inte avsl\u00f6jande av specialv\u00e4gar, s\u00e5som \u00ab~\/\u00bb. F\u00f6r att \u00e5tg\u00e4rda denna skillnad f\u00f6reslogs i f\u00f6reg\u00e5ende version av OpenSSH en ny f\u00f6rl\u00e4ngning av SFTP-protokollet f\u00f6r att avsl\u00f6ja v\u00e4gar ~ \/ och ~user\/.<br \/>\n<br \/>K\u00e4lla: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56751\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.9, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0432 sshd \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0432 \u043a\u043e\u0434\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u043c\u0438 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0432 \u043a\u043e\u0434\u0435. \u0412 \u0442\u0435\u043a\u0443\u0449\u0435\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103424","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.9, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/news\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.9 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 sshd | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.9, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/news\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-02-24T13:36:49+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-02-24T13:36:49+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Utgivning av OpenSSH 8.9 med \u00e5tg\u00e4rd av s\u00e5rbarhet i sshd | ProHoster","description":"Efter sex m\u00e5naders utveckling har sl\u00e4ppet av OpenSSH 8.9 presenterats, en \u00f6ppen implementation av klient och server f\u00f6r att arbeta med SSH 2.0 och SFTP-protokoll.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.9 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 sshd | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0448\u0435\u0441\u0442\u0438 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.9, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/reliz-openssh-8-9-s-ustraneniem-uyazvimosti-v-sshd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-02-24T13:36:49+00:00","article:modified_time":"2022-02-24T13:36:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103424","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-02-24 13:37:31","updated":"2026-02-09 21:42:01","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/103424","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=103424"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/103424\/revisions"}],"predecessor-version":[{"id":160186,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/103424\/revisions\/160186"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=103424"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=103424"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=103424"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}