OpenSSH 10.4 Security Release: Fixes for Use-After-Free, GSSAPI, and SFTP Path Traversal

Vulnerability Overview OpenSSH version 10.4 has been released, containing multiple security fixes and general bug fixes. Below is a summary of the key vulnerabilities: Scope of Impact sftp(1): When downloading files via the command line, a malicious server can redirect files to unexpected locations. scp(1): When copying files between two remote destinations, a malicious server is prevented from writing to the parent directory of the target directory. sftp(1): When using the internal SFTP protocol, long command-line arguments are silently truncated. If security-related options appear at the 10th position or later, they are discarded. sshd(8): When the server joins a Windows Active Directory, the GSSAPI key acceptance check option becomes ineffective. sshd(8): Disabling the forwarding agent does not override the option. sshd(8): GSSAPI pre-authentication is disabled by default when GSSAPI pre-authentication is enabled. sshd(8): Minimum authentication delay is not enforced. ssh(1): A client-side use-after-free issue has been fixed, which could occur when a server changes its host key during key renegotiation. Remediation sftp(1): Fixed the issue where files were downloaded to unexpected locations. scp(1): Fixed the issue where a server could write to the parent directory of the target directory. sftp(1): Fixed the issue where long command-line arguments were silently truncated. sshd(8): Fixed the issue where the GSSAPI key acceptance check option was ineffective. sshd(8): Fixed the issue where disabling the forwarding agent failed to override the option. sshd(8): Fixed the issue where GSSAPI pre-authentication was disabled by default when enabled. sshd(8): Fixed the issue where the minimum authentication delay was not enforced. ssh(1): Fixed the client-side use-after-free issue. POC Code or Exploit Code No specific POC code or exploit code was provided in this advisory. Summary OpenSSH version 10.4 addresses multiple security vulnerabilities, primarily involving and functionalities. These fixes ensure the security and stability of file transfers, preventing malicious servers from exploiting these vulnerabilities. Users are advised to upgrade to OpenSSH 10.4 as soon as possible to obtain these security patches.

Goal Reached Thanks to every supporter — we hit 100%!

OpenSSH 10.4 Security Release: Fixes for Use-After-Free, GSSAPI, and SFTP Path Traversal