The big ticket thing here seems to be mitigation of "Crossing The Streams", a CRIME-style compression side channel that relies on the fact that different sessions share LZ77 state:
I found a small bug in QoS handling in the OpenSSH client under specific conditions. It had a big impact on my workflow but wasn’t a complete showstopper and might not have had an obvious impact on the broader user base. I raised an issue on the tracker and within a day I had a test build, a confirmed fix and a note of which release would carry the fix. It was one of the most positive experiences I’ve had reporting a bug, especially for a non-security issue.
I know this comment doesn’t add much to the conversation about this release, but I’m very grateful to Damien (who handled the issue) and the team for the wonderful job they’re doing on such a core piece of software.
"Updated sandbox for privilege-separated pre-authorization sshd process" is listed as a modification to the open-source project, but I suspect this is out-of-date.
"
* We have seen a number of cases where a security bug identified
* by AI tools is subsequently independently discovered by a
* different researcher. This suggests that adversaries who do not
* report bugs to OSS projects are likely to be able to discover
* these bugs too. Given this, the OpenSSH team will, for now, be
* making more frequent releases to get bugfixes into users' hands
* more quickly rather than batching them until the next planned
* release."
The big ticket thing here seems to be mitigation of "Crossing The Streams", a CRIME-style compression side channel that relies on the fact that different sessions share LZ77 state:
https://arxiv.org/pdf/2609.07709
I found a small bug in QoS handling in the OpenSSH client under specific conditions. It had a big impact on my workflow but wasn’t a complete showstopper and might not have had an obvious impact on the broader user base. I raised an issue on the tracker and within a day I had a test build, a confirmed fix and a note of which release would carry the fix. It was one of the most positive experiences I’ve had reporting a bug, especially for a non-security issue.
I know this comment doesn’t add much to the conversation about this release, but I’m very grateful to Damien (who handled the issue) and the team for the wonderful job they’re doing on such a core piece of software.
> sshd(8): On OS X SDK >= 27, sandboxing is no longer supported as the API we depended upon has been removed and no obvious alternative provided.
https://github.com/openssh/openssh-portable/commit/d4b4c304a...
I look forward to seeing if Apple makes any changes in the fork they ship with the OS: https://github.com/apple-oss-distributions/OpenSSH.
"Updated sandbox for privilege-separated pre-authorization sshd process" is listed as a modification to the open-source project, but I suspect this is out-of-date.
Deprecated since Mountain Lion. https://issuetracker.google.com/40474030
It’s what Apple experimented with before they came up with the current entitlements system.
They mention a donation link: https://www.openbsd.org/donations.html
I wonder what their funding is like.
" * We have seen a number of cases where a security bug identified * by AI tools is subsequently independently discovered by a * different researcher. This suggests that adversaries who do not * report bugs to OSS projects are likely to be able to discover * these bugs too. Given this, the OpenSSH team will, for now, be * making more frequent releases to get bugfixes into users' hands * more quickly rather than batching them until the next planned * release."
I think this is much healthier approach to AI reports than curl has. But I understand both sides.
Really glad to see the rate of security fixes speeding up.