From foo@bar  Tue Sep  1 00:30:03 2026
Format: 1.8
Date: Mon, 31 Aug 2026 23:45:36 +0100
Source: openssh-gssapi
Binary: openssh-client-gssapi openssh-client-gssapi-dbgsym openssh-server-gssapi openssh-server-gssapi-dbgsym
Architecture: m68k
Version: 1:10.5p1-1
Distribution: sid
Urgency: medium
Maintainer: m68k Build Daemon (m68k-osuosl-04) <buildd@m68k-osuosl-04.buildd.org>
Changed-By: Colin Watson <cjwatson@debian.org>
Description:
 openssh-client-gssapi - secure shell (SSH) client, with GSS-API support
 openssh-server-gssapi - secure shell (SSH) server, with GSS-API key exchange
Closes: 1144192
Changes:
 openssh-gssapi (1:10.5p1-1) unstable; urgency=medium
 .
   * password-auth-no-pam: Run test daemon via systemd.
   * New upstream release (closes: #1144192):
     - CVE-2026-73281: ssh-agent(1): fix an interaction between agent locking
       and the session-bind@openssh.com extension that is used to identify
       forwarded agents. These binding requests were refused when the agent
       was locked, with the result that operations that were intended to be
       limited to local use only could be performed remotely, including the
       ability to add PKCS#11 tokens and make use of keys that had
       destination restrictions applied.
     - CVE-2026-73282: ssh(1): avoid potential realloc use-after-free in the
       client if a remote forwarding is added via the local session
       multiplexing socket while a remote forwarding open request is pending
       with the server.
     - CVE-2026-73283: sshd(8): make the authorized_keys "restrict" keyword
       apply correctly to tunnel forwarding too (which is administratively
       disabled by default).
     - ssh-keygen(1): add ability to set or clear the touch-required and
       verify-required flags on FIDO private keys when resetting a private
       key's passphrase.
     - ssh(1): tweak ordering of certificates tried during pubkey
       authentication to prefer FIDO keys that do not require user presence
       (touch) first, and FIDO keys that require user verification via PIN or
       biometrics last. This effectively tries low-friction authenticators
       before higher friction ones.
     - ssh(1): add a "ssh -Z user@host" mode that prints the keys that will
       be tried for public key authentication in the order that they will be
       used.
     - sshd(8) use setproctitle(3) to identify sshd-session when it's acting
       as a post-authentication monitor.
     - ssh-keyscan(1): make reading the server banner a non-blocking
       operation to prevent a stuck server from blocking a many-host keyscan
       from proceeding.
     - sshd(8): use sshpkt_fatal() instead of plain fatal() for errors in the
       packet code as this provides context of the failing peer (address,
       port, user, etc).
     - sshd(8): when signing hostkey proofs for a client UpdateHostKeys
       request, allow each hostkey to perform at most one signature
       operation.
     - ssh-keygen(1): pass back errors from ed25519 key generation, which
       theoretically can fail.
     - sshd(8): move check of public key type against allowed algorithms to
       before parsing of the key sent by the peer. This removes at least some
       key parsing and verification paths from the pre-auth attack surface.
     - ssh-keygen(1): fix double frees (impossible to reach outside of a test
       harness), and also use freezero where possible.
     - sshd(8): fix ChannelTimeout and RekeyLimit not being applied in
       sshd_config Match blocks.
     - sshd(8): in sshd config dump mode, write all directives in mixed case
       for consistency.
     - sshd(8): re-allow PAMServiceName inside a Match block, which was
       incorrectly disabled during a refactoring in openssh-10.4.
Checksums-Sha1:
 143d6cf7fe85a0f009306c151c08f19b79d14e58 3474976 openssh-client-gssapi-dbgsym_10.5p1-1_m68k.deb
 fcee9a9cb53eb9e3acabfad7a01a9816e4ad8e44 719560 openssh-client-gssapi_10.5p1-1_m68k.deb
 ccff24dcc48db8f9e8d4b9f09dcd5adc07cdfe40 15417 openssh-gssapi_10.5p1-1_m68k.buildinfo
 7aa3dd583ae186d4e6384c4dbd0f4d02c992e27c 2653792 openssh-server-gssapi-dbgsym_10.5p1-1_m68k.deb
 7f934cdd860adc9818b0e94b6360c5eb4ea1ba4c 641704 openssh-server-gssapi_10.5p1-1_m68k.deb
Checksums-Sha256:
 95688bb4603cad14d04ed55101814560078a2e797f02ea7f2e22b947b28f9a62 3474976 openssh-client-gssapi-dbgsym_10.5p1-1_m68k.deb
 c70b6574aaf77e9e6e9d83a49aff6f0ac87e0f2d21cdedca44368d9163724419 719560 openssh-client-gssapi_10.5p1-1_m68k.deb
 4d5b2572f772cd7f663ffc2e21916f1a7c1d791c6db498aabd5b1e2b261c9948 15417 openssh-gssapi_10.5p1-1_m68k.buildinfo
 932e88944573fa8c33f63514f41980c2f5880a46887e963e75c47d00df458c12 2653792 openssh-server-gssapi-dbgsym_10.5p1-1_m68k.deb
 081c2d9b04b54e1b2031e708a2dd2e35d7a4c57657b472879dde16403eb59f67 641704 openssh-server-gssapi_10.5p1-1_m68k.deb
Files:
 fe245b1e0a966d08b4fa0c894883c90f 3474976 debug optional openssh-client-gssapi-dbgsym_10.5p1-1_m68k.deb
 e1a24716d2fab125f519b90893dab5e8 719560 net optional openssh-client-gssapi_10.5p1-1_m68k.deb
 f88b967f1bfe4f4b3ea46c399f14d4f4 15417 net optional openssh-gssapi_10.5p1-1_m68k.buildinfo
 6722a9c09a35098eda095ec711fe6635 2653792 debug optional openssh-server-gssapi-dbgsym_10.5p1-1_m68k.deb
 922ff21ddbc7b569896fc88d782fd095 641704 net optional openssh-server-gssapi_10.5p1-1_m68k.deb
Signed-By: Debian buildd autosigning key for m68k-osuosl-04 <buildd_m68k-m68k-osuosl-04@buildd.debian.org>