[ubuntu/resolute-security] openssh 1:10.2p1-2ubuntu3.6 (Accepted)

[Marc Deslauriers]

openssh (1:10.2p1-2ubuntu3.6) resolute-security; urgency=medium

  * SECURITY UPDATE: misinteraction between agent locking and the
    session-bind at openssh.com extension
    - debian/patches/CVE-2026-73281.patch: upstream: Allow session-
      bind at openssh.com requests when the agent is in ssh-agent.c.
    - CVE-2026-73281
  * SECURITY UPDATE: se-after-free for realloc data
    - debian/patches/CVE-2026-73282.patch: upstream: avoid potential realloc
      use-after-free in the client if a in ssh.c.
    - CVE-2026-73282
  * SECURITY UPDATE: restrict keyword did not apply to tunnel forwarding
    - debian/patches/CVE-2026-73283.patch: upstream: make authorized_keys
      "restrict" keyword apply correctly in serverloop.c.
    - CVE-2026-73283

Date: 2026-08-31 20:09:19.753156+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/openssh/1:10.2p1-2ubuntu3.6
-------------- next part --------------
Sorry, changesfile not available.