openssh_9.9p1-1_source.changes ACCEPTED into unstable

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Mon, 23 Sep 2024 21:09:59 -0700
Source: openssh
Architecture: source
Version: 1:9.9p1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenSSH Maintainers <[email protected]>
Changed-By: Colin Watson <[email protected]>
Changes:
 openssh (1:9.9p1-1) unstable; urgency=medium
 .
   * Alias the old Debian-specific SetupTimeOut client option to
     ConnectTimeout rather than to ServerAliveInterval.
   * New upstream release (https://www.openssh.com/releasenotes.html#9.9p1):
     - ssh(1): remove support for pre-authentication compression.
     - ssh(1), sshd(8): processing of the arguments to the "Match"
       configuration directive now follows more shell-like rules for quoted
       strings, including allowing nested quotes and \-escaped characters.
     - ssh(1), sshd(8): add support for a new hybrid post-quantum key
       exchange based on the FIPS 203 Module-Lattice Key Enapsulation
       mechanism (ML-KEM) combined with X25519 ECDH as described by
       https://datatracker.ietf.org/doc/html/draft-kampanakis-curdle-ssh-pq-ke-03
       This algorithm "mlkem768x25519-sha256" is available by default.
     - ssh(1): the ssh_config "Include" directive can now expand environment
       as well as the same set of %-tokens "Match Exec" supports.
     - sshd(8): add a sshd_config "RefuseConnection" option that, if set will
       terminate the connection at the first authentication request.
     - sshd(8): add a "refuseconnection" penalty class to sshd_config
       PerSourcePenalties that is applied when a connection is dropped by the
       new RefuseConnection keyword.
     - sshd(8): add a "Match invalid-user" predicate to sshd_config Match
       options that matches when the target username is not valid on the
       server.
     - ssh(1), sshd(8): update the Streamlined NTRUPrime code to a
       substantially faster implementation.
     - ssh(1), sshd(8): the hybrid Streamlined NTRUPrime/X25519 key exchange
       algorithm now has an IANA-assigned name in addition to the
       "@openssh.com" vendor extension name. This algorithm is now also
       available under this name "sntrup761x25519-sha512"
     - ssh(1), sshd(8), ssh-agent(1): prevent private keys from being
       included in core dump files for most of their lifespans. This is in
       addition to pre-existing controls in ssh-agent(1) and sshd(8) that
       prevented coredumps.
     - All: convert key handling to use the libcrypto EVP_PKEY API, with the
       exception of DSA.
     - sshd(8): add a random amount of jitter (up to 4 seconds) to the grace
       login time to make its expiry unpredictable.
     - sshd(8): fix regression introduced in openssh-9.8 that swapped the
       order of source and destination addresses in some sshd log messages.
     - sshd(8): do not apply authorized_keys options when signature
       verification fails. Prevents more restrictive key options being
       incorrectly applied to subsequent keys in authorized_keys.
     - ssh-keygen(1): include pathname in some of ssh-keygen's passphrase
       prompts. Helps the user know what's going on when ssh-keygen is
       invoked via other tools.
     - ssh(1), ssh-add(1): make parsing user@host consistently look for the
       last '@' in the string rather than the first. This makes it possible
       to more consistently use usernames that contain '@' characters.
     - ssh(1), sshd(8): be more strict in parsing key type names. Only allow
       short names (e.g "rsa") in user-interface code and require full SSH
       protocol names (e.g. "ssh-rsa") everywhere else.
     - regress: many performance and correctness improvements to the
       re-keying regression test.
     - ssh-keygen(1): clarify that ed25519 is the default key type generated
       and clarify that rsa-sha2-512 is the default signature scheme when RSA
       is in use.
     - sshd(8): fix minor memory leak in Subsystem option parsing.
     - All: additional hardening and consistency checks for the sshbuf code.
     - sshd(8): reduce default logingrace penalty to ensure that a single
       forgotten login that times out will be below the penalty threshold.
     - ssh(1): fix proxy multiplexing (-O proxy) bug. If a mux started with
       ControlPersist then later has a forwarding added using mux proxy
       connection and the forwarding was used, then when the mux proxy
       session terminated, the mux master process would issue a bad message
       that terminated the connection.
     - Sync contrib/ssh-copy-id to the latest upstream version.
     - sshd(8): restore audit call before exit that regressed in openssh-9.8.
       Fixes an issue where the SSH_CONNECTION_ABANDON event was not
       recorded.
     - Fix detection of setres*id on GNU/Hurd.
Checksums-Sha1:
 6659072b5811d1ca2a820c8af82d630a79f7e87e 3465 openssh_9.9p1-1.dsc
 5ded7eb0add0b02b5d1a1c4bf5cb2c89d2117b53 1964864 openssh_9.9p1.orig.tar.gz
 6f100e4757e1942d7b5e01310fcaf624b71f6740 833 openssh_9.9p1.orig.tar.gz.asc
 74312e9c0bd3cc7be50a61114302c082e51dfb12 195332 openssh_9.9p1-1.debian.tar.xz
Checksums-Sha256:
 d23623e4679bbaaf72f78e95a25c2ce4755bbcbc029f9a6152967ca0f3df2e99 3465 openssh_9.9p1-1.dsc
 b343fbcdbff87f15b1986e6e15d6d4fc9a7d36066be6b7fb507087ba8f966c02 1964864 openssh_9.9p1.orig.tar.gz
 0a3c462e9cb862bf0bb3a56c7251091f1c88a47724d10cede3ea018f97cf1c94 833 openssh_9.9p1.orig.tar.gz.asc
 763ab24503717d7820ccca624d38731cddd883c2aab5baf986f41dbde1b9c82b 195332 openssh_9.9p1-1.debian.tar.xz
Files:
 b2855da38c96a64f5f8e9006660f32b2 3465 net standard openssh_9.9p1-1.dsc
 1893c9b712eb8c55ec2d5146e7323b92 1964864 net standard openssh_9.9p1.orig.tar.gz
 8c3a6720795ce7234ba4e1532769bac6 833 net standard openssh_9.9p1.orig.tar.gz.asc
 07551163723a0b7239aab30d761f13d5 195332 net standard openssh_9.9p1-1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEErApP8SYRtvzPAcEROTWH2X2GUAsFAmbyO9MACgkQOTWH2X2G
UAtPUA//epoXszBabtE41yT+tFVLJuTnmz1eg0mjQ4gKlUiiJexJElM2YVsV1+Zo
lA3lVMIim7AAr2FIHG03F3Dz+h9XBsPJ5CgkyVr+uJQiXCJfl6p4Yo0CwjeQ6Jr7
4fJS7f7J8cFhD1kSz4zBl2QwVAhBRU/bbX+vtnKxbmzc/OnIVGxvUd54k3B4s+V0
+AExoPbea0khvYmUArwOGuIQMoxO94GYUvtTVQ1Pb0J8xZy9k048MRLfwFShS3Vy
uN7R5oOHreIOgwLw411UyagaxavIuwWu8yB2zs3VC1Ruthjmzxh0rhTfNm2Ym9EC
kdMyxIvz4xTco/DtMsWt4a7zvkrSjYhHwPz5YcDQkqEBCfOi1WzBo8M1B2GObvVK
/nxv7nsaJysAuzMS9bK6mHxQdxmF3zJ/aJwnQ8Cf1pDjlT67+T78QeURvp+KxAIx
dHHv6AtQBpBHyvEi2jnOjmykYvixtCDzP7s9LqI8/Xak4CM136RHqCUNRdXJyKuB
UD0dzkySkTxDCXn+8uTcG7rjSF5W8ta7xduG1t1i9r6fbKvW1fRkpEGe23J1FZEh
/UqGJnoQ0Pb8lMdIfgUIkAreZH1Jmt0+MaaLA9bgWtZEpEtgSM/rG6yZDvO8gAa2
/o0Zedq5FSl3a8pwsiNX2JQ9IFEmwqjliv3m95h7NxHYxrl/HZg=
=qyRk
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCZvI9wgAKCRCb9qggYcy5
IXp9AP97Xl8nIoL5qEwWRwi2hLdh8wjnxfQyZFtQfY4OP81UsQD/bSpQBwc0rlWp
lyJDDhmg69RyW8uen8hMdfIMhi/ZwAA=
=VzDj
-----END PGP SIGNATURE-----