[DragonFlyBSD - Bug #3403] update crypto/openssh to 10.0

[sigttou]

Issue #3403 has been updated by sigttou.

File 0001-openssh-security-backports.patch added

This is a limited backport of the two fixes discussed here:
- Reject every nonzero host-verification error, including allocation failure (CVE-2025-26465).
- Apply DisableForwarding to agent and X11 requests.

The changes follow the OpenSSH fixes carried by Debian. The forwarding fix is Damien Miller's upstream commit fc86875e6acb, reported by Tim Rice.


----------------------------------------
Bug #3403: update crypto/openssh to 10.0
http://bugs.dragonflybsd.org/issues/3403#change-14777

* Author: pmjdebruijn
* Status: New
* Priority: Normal
* Target version: 6.6
* Start date: 2026-02-24
----------------------------------------
It seems OpenSSH 10.0 and further are free of vulnerabilities (though I'm not sure what specifically applies to DragonFly):

https://www.openssh.org/security.html

Sticking to 10.0 (and not further) may be beneficial, as it would allow you to pull backported security fixes from (for example) Debian Trixie, which could easy maintenance load...

---Files--------------------------------
0001-openssh-security-backports.patch (2.17 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account