UbuntuUpdates.org

Package "openssh-sftp-server"

Name: openssh-sftp-server

Description:

secure shell (SSH) sftp server module, for SFTP access from remote machines
Latest version: 1:10.5p1-1ubuntu3.1
Release: stonking (26.10)
Level: security
Repository: main
Head package: openssh
Homepage: https://www.openssh.com/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "openssh-sftp-server"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "openssh-sftp-server" in Stonking

Repository Area Version
base main 1:10.5p1-1ubuntu2
proposed main 1:10.5p1-1ubuntu3

Changelog

Version: 1:10.5p1-1ubuntu3.1 2026-10-19 14:07:48 UTC

openssh (1:10.5p1-1ubuntu3.1) stonking-security; urgency=medium

  * SECURITY UPDATE: sftp directory traversal
    - debian/patches/CVE-2026-106552.patch: upstream: sftp: be stricter in
      accepting paths returned by the in sftp-client.c, sftp.c.
    - CVE-2026-106552
  * SECURITY UPDATE: incorrect GSSAPIAuthentication auth persistence
    - debian/patches/CVE-2026-106553-1.patch: upstream: Reset GSSAPI client
      state before authentication in auth2.c, gss-serv.c, monitor.c, ssh-gss.h.
    - debian/patches/CVE-2026-106553-2.patch: upstream: Only store GSSAPI creds
      when authn succeeds in gss-serv.c, ssh-gss.h.
    - debian/patches/CVE-2026-106553-3.patch: upstream:
      ssh_gssapi_cleanup_global_client() needs a prototype in gss-serv.c, ssh-
      gss.h.
    - CVE-2026-106553
    - CVE-2026-106555
  * SECURITY UPDATE: incorrect use of LZ77 dictionary coder
    - debian/patches/CVE-2026-106582.patch: upstream: Disable LZ77 dictionary
      coder to avoid a potential in packet.c.
    - CVE-2026-106582
  * SECURITY UPDATE: invalid chars in command-line username
    - debian/patches/CVE-2026-106583-1.patch: upstream: Further restrict the
      characters allowed in a command-line in readconf.c.
    - debian/patches/CVE-2026-106583-2.patch: upstream: Add test for
      proxycommand percent expansions. in regress/percent.sh.
    - debian/patches/CVE-2026-106583-3.patch: avoid ksh-ism in regress test in
      regress/percent.sh.
    - CVE-2026-106583
  * SECURITY UPDATE: incorrect cert expiry in ssh-keygen
    - debian/patches/CVE-2026-106584.patch: upstream: Correct handling of DST
      when converting dates in misc.c.
    - CVE-2026-106584
  * SECURITY UPDATE: missing maximum packet length check
    - debian/patches/CVE-2026-106585.patch: upstream: Check that compressed
      payloads don't inflate beyond the in packet.c.
    - CVE-2026-106585
  * SECURITY UPDATE: incorrect restrict keyword usage in tunnel forwarding
    - debian/patches/CVE-2026-106586-1.patch: upstream: Propagate
      authorized_keys "resrict" keyword in auth-options.c.
    - debian/patches/CVE-2026-106586-2.patch: upstream: correctly check
      sshauthopt->restricted merging in regress/unittests/authopt/tests.c.
    - debian/patches/CVE-2026-106586-3.patch: upstream: simpler in
      regress/unittests/authopt/tests.c.
    - CVE-2026-106586
  * SECURITY UPDATE: "none" value confusion in options
    - debian/patches/CVE-2026-106587.patch: upstream: Correctly handle some
      options that accept "none" in servconf.c.
    - CVE-2026-106587

 -- Marc Deslauriers Thu, 15 Oct 2026 09:24:26 -0400
CVE-2026-106552 In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive cop
CVE-2026-106553 In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.
CVE-2026-106555 In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.
CVE-2026-106582 In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing th
CVE-2026-106583 In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
CVE-2026-106584 In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a sligh
CVE-2026-106585 In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed
CVE-2026-106586 In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different
CVE-2026-106587 In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a fe


About   -   Send Feedback to @ubuntu_updates