Published release of OpenSSH 10.5, an open client and server implementation for running SSH 2.0 and SFTP protocols. Key changes:
- The portable version of OpenSSH now requires support for Elliptic Curve Cryptography (ECC) in the libcrypto library, including support for NISTP521 elliptic curve cryptography. In the libcrypto implementations from the LibreSSL, OpenSSL, BoringSSL and AWS LC projects, such support is enabled by default.
- In the ssh-keygen utility, when resetting the password for private keys for FIDO tokens, the touch-required and verify-required flags have been set, requiring confirmation from the user.
- In the ssh utility, the order of using certificates during authentication has been changed by public keys – first of all, FIDO keys that do not require user action are now used, and last of all, keys that require verification by PIN code or biometrics.
- Added the “ssh -Z user” command, which displays the keys in the order of their use for public key authentication.
- Security problems have been fixed:
- Incorrect processing of session binding requests when SSH is blocked has been fixed Agent, which led to the fact that instead of denying access, the SSH Agent allowed remotely performing operations that should have been available only locally, such as adding PKCS#11 tokens and using keys tied in the settings to specific servers.
- The ssh client eliminated the potential use-after-free access to memory that occurs when multiplexing SSH connections through one socket in the case of adding a new port forwarder to the moment when the client is still waiting for a response from the server to open the previous forwarding.
- In sshd, the restrictions specified through the “restrict” flag in the authorized_keys file have been adjusted correctly for redirected tunnels.
/Reports, release notes, official announcements.