[ubuntu/questing-updates] openssh 1:10.0p1-5ubuntu5.4 (Accepted)

[Ubuntu Archive Robot]

openssh (1:10.0p1-5ubuntu5.4) questing-security; urgency=medium

  * SECURITY UPDATE: unexpected scp setuid and setgid
    - debian/patches/CVE-2026-35385.patch: clear setuid/setgid bits from
      downloaded files in scp.c.
    - CVE-2026-35385
  * SECURITY UPDATE: command execution via shell metacharacters in username
    - debian/patches/CVE-2026-35386-pre1.patch: apply validity rules on
      ProxyJump usernames and hostnames in readconf.c, readconf.h, ssh.c.
    - debian/patches/CVE-2026-35386.patch: move username check earlier in
      ssh.c.
    - debian/patches/CVE-2026-35386-2.patch: adapt to username validity
      check change in regress/percent.sh.
    - CVE-2026-35386
  * SECURITY UPDATE: use of unintended ECDSA algorithms
    - debian/patches/CVE-2026-35387_35414.patch: correctly match ECDSA
      signature algorithms against algorithm allowlists in
      auth2-hostbased.c, auth2-pubkey.c, sshconnect2.c.
    - CVE-2026-35387
  * SECURITY UPDATE: missing connection multiplexing confirmation
    - debian/patches/CVE-2026-35388.patch: add missing askpass check in
      mux.c.
    - CVE-2026-35388
  * SECURITY UPDATE: authorized_keys principals option mishandling
    - debian/patches/CVE-2026-35387_35414.patch: check for commas in
      auth2-pubkeyfile.c.
    - CVE-2026-35414

openssh (1:10.0p1-5ubuntu5.2) questing; urgency=medium

  * repair test after changes to percent expansion of usernames
    (LP: #2147451)

Date: 2026-04-28 13:16:10.740566+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <ubuntu-archive-robot at lists.canonical.com>
https://launchpad.net/ubuntu/+source/openssh/1:10.0p1-5ubuntu5.4
-------------- next part --------------
Sorry, changesfile not available.