Portable OpenSSH 10.6p2 fixes a serious password-check bypass affecting Linux systems where OpenSSH is built and run without PAM support.
The release notes specifically call out musl libc systems with PAM disabled.
The issue may be exploitable through the OpenSSH service; maintainers say the root cause lies outside the project, which added a protective measure to prevent exploitation.
The release notes specifically mention systems that use the musl libc library and have PAM disabled.
The creators of OpenSSH say the cause lies outside of OpenSSH itself. However, they have added protection to the service that accepts connections to prevent the bypass. They urge administrators of affected systems to install the update as soon as it is available for their Linux distribution.
The release also fixes an issue that caused increased CPU usage for less than a second when a specific setting was enabled. It also fixes unexpected behavior when typing a passphrase in OpenSSH tools was interrupted. It also adds support for a hybrid digital signature method that can be used by certificate authorities. The method is designed to withstand future quantum computers.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
OpenVPN 2.7.9 fixes two security issues on Windows
↗
The developers also plan to release security patches more frequently. They say they are seeing an increase in reports of issues created or assisted by AI. Many have no practical impact, but others involve real problems that are later identified by independent researchers. The team believes that malicious actors may discover such issues without reporting them.
The version also maintains the previously announced removal of the option -R in the order scp. This option runs the command on another computer, so that files are transferred directly between two remote computers. As of version 10.6, its use displays a warning. In a future release, the option will be ignored and the transfer will be done via the computer from which the user is starting.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
