OpenSSH 9.8 released

Contributed by Peter N. M. Hansteen on 2024-07-01 from the SSH! listen to the sound of bugs fixed dept.

In a fediverse post, Damien Miller (djm@) announced the availability of the new OpenSSH version 9.8:

OpenSSH 9.8 has just been released. This release includes a fix for a critical race condition in sshd that could be exploited for remote code execution so you should definitely patch or upgrade. It also contains a fix for a minor issue in ssh that saw the recently-added ObscureKeystrokeTiming feature work the opposite way as intended.
There are some new features too. Please see the release notes at https://openssh.com/releasenotes.html for more details

(Comments are closed)

Comments

By Damien Miller (djm) djm@mindrot.org on 2024-07-01 11:09

See also the Qualys advisory, which has detailed exploitation information: https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
Comments
1. By grey (grey) on 2024-07-01 23:07 http://www.artkiver.com
  Thanks so much for this!
  
  I appreciate Qualys' in depth bug explorations and plain text formatting.
  
  In downstreaming news, hopefully this PR for MacPorts (https://github.com/macports/macports-ports/pull/24754) will get merged soon, though I'll be the first to admit I don't think I have ever properly wrapped my head around GitHub's browser based code review tools.
  
  At least the proof of concept was for Linux and OpenBSD doesn't appear to be vulnerable!
  
  Hopefully macOS and other OSes may also be immune? Though it's my general observation that when an exploit is found, others may refactor it. The tidbit in Qualys' write up about this being related to something Mark Dowd had reported back in 2006 was fascinating contextually in such regards.
  
  Testing locally at least, 9.8p1 is working great!
  
  % ssh -V OpenSSH_9.8p1, LibreSSL 3.9.2

Latest Articles

Wed, Jan 08
- 10:07 rpki-client 9.4 released (0)
Mon, Dec 30
- 03:57 Game of Trees 0.107 released (0)
Thu, Dec 19
- 16:38 rpki-client stricter aging policy for Trust Anchor certificates commited to -current (0)
- 08:04 FRAME sockets added to OpenBSD (0)
Wed, Dec 18
- 19:57 OpenBGPD 8.7 released (0)
Sat, Nov 30
- 18:42 Initial list of 21 EuroBSDcon 2024 videos released (0)
- 18:39 Rafael Sadowski on dpb(1) (1)
Fri, Nov 29
- 09:31 -current now has more flexible performance policy (0)
Mon, Nov 25
- 07:13 unwind: wildcard in blacklist (0)

Credits

Copyright © 2004-2008 Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to April 2nd 2004 as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]