CVS commit: pkgsrc/security/openssh

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Thu Nov  5 20:49:21 UTC 2026

Modified Files:
        pkgsrc/security/openssh: Makefile distinfo

Log Message:
openssh: update to 10.6p2.

Changes since OpenSSH 10.6p1
============================

This release contains a critical security workaround that affects
Linux systems that use the musl libc and PAM disabled.

This release also includes a number of bugfixes that had already
been committed on the portable OpenSSH V_10_6 stable branch.

Security
========

 * sshd(8): avoid password authentication bypass that is exploitable
   through sshd(8) that affects some Linux systems when built and run
   with PAM support disabled. We consider the root cause of this bug
   to be outside sshd, but it is exploitable via sshd and can be
   avoided there.

   This bug was reported by Özgün Kültekin of Wakefield
   (wakefield.co)

Bugfixes
--------

 * sshd(8), ssh(1): enable the post-quantum hybris signature scheme
   ssh-mldsa44-ed25519 as an allowed CA signature algorithm.

 * ssh(1), sshd(8): fix <1 second CPU spin if ChannelTimeout was in
   use.

Portability
-----------

 * sshd(8): fix compilation on (old) platforms that set SKIP_PRIVDROP

 * ssh(1), sshd(8): fix detection of Azerbaijani locales

 * sshd(8), ssh-agent(1): fix creation of agent sockets on platforms
   without the openat(2) syscall.

 * ssh(1), ssh-add(1), ssh-keygen(1): fix some strange behaviour if
   SIGINT/SIGQUIT was received while reading a passphrase.

 * sshd(8): allow restart_syscall(2) in seccomp sandbox; bz4036


To generate a diff of this commit:
cvs rdiff -u -r1.299 -r1.300 pkgsrc/security/openssh/Makefile
cvs rdiff -u -r1.135 -r1.136 pkgsrc/security/openssh/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/openssh/Makefile
diff -u pkgsrc/security/openssh/Makefile:1.299 pkgsrc/security/openssh/Makefile:1.300
--- pkgsrc/security/openssh/Makefile:1.299      Wed Oct  7 15:22:05 2026
+++ pkgsrc/security/openssh/Makefile    Thu Nov  5 20:49:21 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.299 2026/10/07 15:22:05 he Exp $
+# $NetBSD: Makefile,v 1.300 2026/11/05 20:49:21 wiz Exp $
 
-DISTNAME=              openssh-10.6p1
+DISTNAME=              openssh-10.6p2
 CATEGORIES=            security
 MASTER_SITES=          ${MASTER_SITE_OPENBSD:=OpenSSH/portable/}
 

Index: pkgsrc/security/openssh/distinfo
diff -u pkgsrc/security/openssh/distinfo:1.135 pkgsrc/security/openssh/distinfo:1.136
--- pkgsrc/security/openssh/distinfo:1.135      Wed Oct  7 15:22:05 2026
+++ pkgsrc/security/openssh/distinfo    Thu Nov  5 20:49:21 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.135 2026/10/07 15:22:05 he Exp $
+$NetBSD: distinfo,v 1.136 2026/11/05 20:49:21 wiz Exp $
 
-BLAKE2s (openssh-10.6p1.tar.gz) = f2ac2881839430ca50df9c8fe56ac786d01c62c231fd9c5a7f321e01f34dfeec
-SHA512 (openssh-10.6p1.tar.gz) = 243e07c8c68c649552ee019e6aac4393634de6e403cb793b3cd756d5c46e84cc8b2b560e6c0b36e8fb48979b109f888317411a9d640583109117ea621f27700a
-Size (openssh-10.6p1.tar.gz) = 2355244 bytes
+BLAKE2s (openssh-10.6p2.tar.gz) = f3e33de5336f0fe7d2279c0d2600b6bd38b7b2fc4d342b189773c2f5d9cdba64
+SHA512 (openssh-10.6p2.tar.gz) = 70696ed12bd1be04f67440415528f1ced1ef68c8ee7836e587395618d0992f3fd20c9498c44d46ad9f5806b9a73ce256fd6a2807f9c5c02e6496cf06816c749e
+Size (openssh-10.6p2.tar.gz) = 2355372 bytes
 SHA1 (patch-Makefile.in) = d58adac52e169f25f0b0c3a321f154b44b0475e6
 SHA1 (patch-atomicio.c) = c4ec07e00b29fe902c38b202e6572a290a8b84f9
 SHA1 (patch-configure.ac) = 680d8fdfb7b63c7bf25b8340c7f68defb71703a0