[openssh-commits] [openssh] branch master updated (6f74eb3c5 -> d6a589d3c)

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a change to branch master
in repository openssh.

    from 6f74eb3c5 Dropbear master -> main here too.
     new 09c2eeb9c upstream: mention that ssh-keyscan output is only as trustworthy as
     new 8dec7df34 upstream: avoid possible NULL deref; from Swival scanner
     new 36480181f upstream: resist that return ".." via remote glob during
     new 1b39f3965 upstream: avoid download to server-controlled path when performing
     new c1cebbc7c upstream: avoid situation where sftp_download() could get stuck in
     new c58b363e4 upstream: fix ECDSA order check for curves with cofactor != 1. All
     new 1cfbed8a1 upstream: Fix bounds checking when signing messages of length
     new d6a589d3c upstream: make ssh-add open it's connection to the agent after it

The 8 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Detailed log of new commits:

commit d6a589d3c8530375c2d56bcfb914575a7fcd3715
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Mon Jun 29 02:13:05 2026 +0000

    upstream: make ssh-add open it's connection to the agent after it
    
    has finished getopt() processing and not before. This allows the -v flag to
    work properly.
    
    ok jca@
    
    OpenBSD-Commit-ID: b9ac820018875aeb5b43ae2119a70c16a5cd2aef

commit 1cfbed8a131de166d86fbf5ac3245d55046cfab3
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Mon Jun 29 02:08:55 2026 +0000

    upstream: Fix bounds checking when signing messages of length
    
    greater than will fit in a size_t. In OpenSSH, messages sizes are bounded by
    SSHBUF_SIZE_MAX so this was unreachable. From Swival scanner.
    
    OpenBSD-Commit-ID: 31ab874abe21a528fa995d78023c5ad9444a31e1

commit c58b363e4f7c10134b583fc92556229bf6c2c16b
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Mon Jun 29 01:58:29 2026 +0000

    upstream: fix ECDSA order check for curves with cofactor != 1. All
    
    supported EC curves have cofactor 1, so this is a nop. From Swival scanner
    
    OpenBSD-Commit-ID: 4ae44cc97714fcb6d19fa56714ede56c1ef521e1

commit c1cebbc7c69acfe5df07b4a95e4c32cebc3e105a
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Mon Jun 29 01:53:21 2026 +0000

    upstream: avoid situation where sftp_download() could get stuck in
    
    a loop if a broken server repeatedly returned zero length while reading a
    file. Identified by Swival scanner
    
    OpenBSD-Commit-ID: 53f1de5065ff01952d2abb51747c2418ce21cd96

commit 1b39f39657d2e58f8ec57341581a39bbf0be645b
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Mon Jun 29 01:47:21 2026 +0000

    upstream: avoid download to server-controlled path when performing
    
    download on the commandline. From Swival scanner
    
    OpenBSD-Commit-ID: d1b2c44305fdfe6d51eed9ecc727e59478bf311f

commit 36480181fa22f98e180b4f9e10203480c0346c78
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Sun Jun 28 23:47:16 2026 +0000

    upstream: resist that return ".." via remote glob during
    
    remote/remote copies, similar to fixes for bz3871 for remote/local copies.
    From Swival scanner
    
    OpenBSD-Commit-ID: c0c20a1b746db55c08e53658bf21ea9405b300a5

commit 8dec7df34b38ea510b5548a020f2664e59700d23
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Sun Jun 28 23:31:28 2026 +0000

    upstream: avoid possible NULL deref; from Swival scanner
    
    OpenBSD-Commit-ID: 62ea8e12b7cddee933596e72f8ab0f7364147c0f

commit 09c2eeb9c8a0f42716d67548c75a6f4870732caa
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Fri Jun 26 06:17:13 2026 +0000

    upstream: mention that ssh-keyscan output is only as trustworthy as
    
    the network between it and the SSH server; ok markus@
    
    OpenBSD-Commit-ID: 067845df7e8eb776408de5f23a2e6e7019945834

Summary of changes:
 authfd.c          |  4 ++--
 ed25519-openssl.c |  6 +++++-
 scp.c             |  6 +++++-
 sftp-client.c     | 16 +++++++++++++---
 sftp.c            | 11 +++--------
 ssh-add.c         | 33 +++++++++++++++++----------------
 ssh-keyscan.1     | 13 +++++++++++--
 sshconnect2.c     |  5 +++--
 sshkey.c          |  6 +++++-
 9 files changed, 64 insertions(+), 36 deletions(-)

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.