[openssh-commits] [openssh] branch master updated (23a7c4d12 -> 710cd5abc)

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a change to branch master
in repository openssh.

    from 23a7c4d12 upstream: revert bits that weren't ready for commit yet
     new fa447bd58 upstream: check key and IV length received in privsep state
     new 710cd5abc upstream: set FD_CLOEXEC on the fds between sftp and its ssh

The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Detailed log of new commits:

commit 710cd5abcea22aeddbd5d5d661c224eaa05e47b9
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Tue Jun 30 00:10:48 2026 +0000

    upstream: set FD_CLOEXEC on the fds between sftp and its ssh
    
    process, avoids risk of subcommands that write on odd fds breaking the
    connection. GHPR693 from Manuel Einfalt; feedback deraadt@ ok dtucker@
    
    OpenBSD-Commit-ID: 91b12cd66580dab6b3bfe5e507a1a8310c8f9149

commit fa447bd5836f6d1c742c543207a3a6ec2909da75
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Tue Jun 30 00:09:01 2026 +0000

    upstream: check key and IV length received in privsep state
    
    transfer exactly match the expected sizes for the selected cipher; partially
    redundant to similar checks in cipher_init(), but nice to be more exact.
    
    GHPR from jmestwa-coder; ok dtucker@
    
    OpenBSD-Commit-ID: d4a9deef194cc44189e835ac59b7b800b9b5c281

Summary of changes:
 packet.c | 7 ++++++-
 sftp.c   | 5 +++--
 2 files changed, 9 insertions(+), 3 deletions(-)

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.