Bug#1130595: openssh: CVE-2026-3497

On Sat, Apr 04, 2026 at 12:12:33PM +0200, Salvatore Bonaccorso wrote:
> On Fri, Apr 03, 2026 at 11:52:40PM +0200, Moritz Mühlenhoff wrote:
> > Am Fri, Apr 03, 2026 at 10:50:34AM +0200 schrieb Salvatore Bonaccorso:
> > > Were you able to test the kerberized SSH setup? As the debdiff looked
> > > okay to me i would otherwise say Colin can upload already to
> > > security-master and we can do further tests before a DSA release.
> > 
> > I was waiting for the upload to test the built binaries :-)
> > I have no doubt they'll work.
> 
> Ok let's proceed as follows: Colin feel free to upload the acked
> debdiffs (finalizing the changelog) please. Then Moritz can do further
> tests with the uploaded package and we can release the DSA (without
> the new set of CVEs, they can later on go in via point release once
> they are fixed in unstable).

Ah, I got the wrong end of the stick about who was waiting for what, and 
I was also away for a few days.  I've uploaded 1:10.0p1-7+deb13u2 to 
trixie-security and 1:9.2p1-2+deb12u9 to bookworm-security now.

(We have specific autopkgtest coverage for Kerberized SSH, so while it's 
always possible I got some edge case wrong, I'm reasonably sure that at 
least the happy path is fine.)

Thanks,