[openssh-commits] [openssh] branch master updated (e27b6cc2e -> c07ea2180)

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a change to branch master
in repository openssh.

    from e27b6cc2e upstream: Disallow nul byte in received scp -O filename. Not
     new 39cba820e upstream: handle max-pk-ok path identically when the incoming user
     new c07ea2180 upstream: sftp: be stricter in accepting paths returned by the

The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Detailed log of new commits:

commit c07ea2180adebd6019a6ebdd89becb9d9f4b4897
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Thu Oct 1 03:11:49 2026 +0000

    upstream: sftp: be stricter in accepting paths returned by the
    
    server for SSH_FXP_REALPATH or SSH2_FXP_READDIR replies, as these can be used
    in some situations to decide the destination path for recursive transfers.
    
    Report and patch from Junghoon Cho
    
    OpenBSD-Commit-ID: ad357002a1b75c87113f01086a9f0c12c36082d8

commit 39cba820eda49ea084c9270917dfb5efc03f08cc
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Thu Oct 1 02:01:51 2026 +0000

    upstream: handle max-pk-ok path identically when the incoming user
    
    is invalid; avoids max-pk-ok feature presenting a username validity oracle
    
    analysis and patch from Chris Rohlf in collaboration with Claude and
    Anthropic Research
    
    OpenBSD-Commit-ID: c05d01b1724c76c9e30ed5e0f06686820f94bce8

Summary of changes:
 auth2-pubkey.c | 14 ++++++++------
 sftp-client.c  |  5 +++--
 sftp.c         | 14 ++++++++++----
 3 files changed, 21 insertions(+), 12 deletions(-)

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.