CVS commit: pkgsrc/security/openssh

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Tue Aug 11 07:16:40 UTC 2026

Modified Files:
        pkgsrc/security/openssh: Makefile distinfo

Log Message:
openssh: update to 10.5p1.

Changes since OpenSSH 10.4
==========================

This release contains a number of security fixes and small bugfixes.

Security
========

 * ssh-agent(1): fix an interaction between agent locking and the
   session-bind%openssh.com@localhost extension that is used to identify
   forwarded agents. These binding requests were refused when the
   agent was locked, with the result that operations that were
   intended to be limited to local use only could be performed
   remotely, including the ability to add PKCS#11 tokens and make
   use of keys that had destination restrictions applied.
   Reported by sn0x-sharma

 * ssh(1): avoid potential realloc use-after-free in the client if a
   remote forwarding is added via the local session multiplexing
   socket while a remote forwarding open request is pending with the
   server. Report and fix from Brian Mingus of Cognatory

 * sshd(8): make the authorized_keys "restrict" keyword apply
   correctly to tunnel forwarding too (which is administratively
   disabled by default). Reported by Erichen, Institute of Computing
   Technology, Chinese Academy of Sciences

New features
------------

 * ssh-keygen(1): add ability to set or clear the touch-required and
   verify-required flags on FIDO private keys when resetting a
   private key's passphrase.

 * ssh(1): tweak ordering of certificates tried during pubkey
    authentication to prefer FIDO keys that do not require user
    presence (touch) first, and FIDO keys that require user
    verification via PIN or biometrics last. This effectively tries
    low-friction authenticators before higher friction ones.

 * ssh(1): add a "ssh -Z user@host" mode that prints the keys that
   will be tried for public key authentication in the order that
   they will be used.

 * sshd(8) use setproctitle(3) to identify sshd-session when its
   acting as a post-authentication monitor.

Bugfixes
--------

 * ssh-keyscan(1): make reading the server banner a non-blocking
   operation to prevent a stuck server from blocking a many-host
   keyscan from proceeding.

 * sshd(8): use sshpkt_fatal() instead of plain fatal() for errors
   in the packet code as this provides context of the failing peer
   (address, port, user, etc).

 * sshd(8): when signing hostkey proofs for a client UpdateHostKeys
   request, allow each hostkey to perform at most one signature
   operation.

 * sshd(8) fix GSSAPI option names, that were broken during a
   servconf.c refactoring in openssh-10.4; bz3974.

 * ssh-keygen(1): pass back errors from ed25519 key generation, which
   theoretically can fail. GHPR702.

 * sshd(8): move check of public key type against allowed algorithms
   to before parsing of the key sent by the peer. This removes at
   least some key parsing and verification paths from the pre-auth
   attack surface. Suggested by Christopher Paul Rohlf of Anthropic.

 * ssh-keygen(1): fix double frees (impossible to reach outside of a
   test harness), and also use freezero where possible. From
   Christopher Paul Rohlf at Anthropic.

 * sshd(8): fix ChannelTimeout and RekeyLimit not being applied in
   sshd_config Match blocks.

 * sshd(8): in sshd config dump mode, write all directives in mixed
   case for consistency

Portability
-----------

 * sshd(8): re-allow PAMServiceName inside a Match block, which
   was incorrectly disabled during a refactoring in openssh-10.4.
   bz3987


To generate a diff of this commit:
cvs rdiff -u -r1.293 -r1.294 pkgsrc/security/openssh/Makefile
cvs rdiff -u -r1.131 -r1.132 pkgsrc/security/openssh/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/openssh/Makefile
diff -u pkgsrc/security/openssh/Makefile:1.293 pkgsrc/security/openssh/Makefile:1.294
--- pkgsrc/security/openssh/Makefile:1.293      Mon Jul  6 16:31:47 2026
+++ pkgsrc/security/openssh/Makefile    Tue Aug 11 07:16:40 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.293 2026/07/06 16:31:47 wiz Exp $
+# $NetBSD: Makefile,v 1.294 2026/08/11 07:16:40 wiz Exp $
 
-DISTNAME=              openssh-10.4p1
+DISTNAME=              openssh-10.5p1
 CATEGORIES=            security
 MASTER_SITES=          ${MASTER_SITE_OPENBSD:=OpenSSH/portable/}
 

Index: pkgsrc/security/openssh/distinfo
diff -u pkgsrc/security/openssh/distinfo:1.131 pkgsrc/security/openssh/distinfo:1.132
--- pkgsrc/security/openssh/distinfo:1.131      Mon Jul  6 16:31:47 2026
+++ pkgsrc/security/openssh/distinfo    Tue Aug 11 07:16:40 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.131 2026/07/06 16:31:47 wiz Exp $
+$NetBSD: distinfo,v 1.132 2026/08/11 07:16:40 wiz Exp $
 
-BLAKE2s (openssh-10.4p1.tar.gz) = b564ae804db768051fa4235c0f77352f004dde6dfe87dc67b5f0e3946a0311d1
-SHA512 (openssh-10.4p1.tar.gz) = c49600022a3a3f0f0ba4284072cccbe1088030cd175ea166e08251224712731f97cb1a3f039d19f71714c537ab88b177602be0932bc35a26f3227dc09c43f37c
-Size (openssh-10.4p1.tar.gz) = 2321796 bytes
+BLAKE2s (openssh-10.5p1.tar.gz) = 0a7483f05aa98e39cd4c7c8f2c259a3f5dd96d784e8934f6a7e94d6bf0a47c83
+SHA512 (openssh-10.5p1.tar.gz) = 5336c1945527b29ed59cc500fa8bfbd918f5ba97e85512daad9ab7241418929bf7152d300e5f3c5f9a8c8d699dfde5a64c5faa4fc33b2758ab52dd04040d6284
+Size (openssh-10.5p1.tar.gz) = 2333659 bytes
 SHA1 (patch-Makefile.in) = d58adac52e169f25f0b0c3a321f154b44b0475e6
 SHA1 (patch-configure.ac) = 10894c1b98298a1672ec151a223f6180bf841fa4
 SHA1 (patch-defines.h) = c1dbb18076b4fa399b0f791bb543ef1e5cb0408e