OpenSSH 10.2 has just been released. It will be available from the mirrors listed at https://www.openssh.com/ shortly. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support. Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at: https://www.openssh.com/donations.html Future deprecation warning -------------------------- * A future release of OpenSSH will deprecate support for SHA1 SSHFP records due to weaknesses in the SHA1 hash function. SHA1 SSHFP DNS records will be ignored and ssh-keygen -r will generate only SHA256 SSHFP records. The SHA256 hash algorithm, which has no known weaknesses, has been supported for SSHFP records since OpenSSH 6.1, released in 2012. Changes since OpenSSH 10.1 ========================= This is a bugfix release, primarily to fix a problem that rendered ssh(1) unusable when ControlPersist was enabled. Bugfixes -------- * ssh(1): fix mishandling of terminal connections when ControlPersist was active that rendered the session unusable. bz3872 * ssh-keygen(1): fix download of keys from PKCS#11 tokens. * ssh-keygen(1): fix CA signing operations when the CA key is held in a ssh-agent(1). bz3877 Portability ----------- * All: support platforms without mmap(2), e.g. WASM builds such as https://hterm.org * All: fix builds on FreeBSD for missing fnctl.h include. * All: fix builds on MacOS <10.12 Sierra, which lacks clock_gettime(3) * sshd(8): don't PAM_RHOST if the remote host is the "UNKNOWN" placeholder name. Avoids potential hangs in some PAM modules as they try to resolve it. Note, sshd(8) only uses the "UNKNOWN" name when the connection is not on an IPv4 or IPv6 socket. Checksums: ========= SHA1 (openssh-10.2.tar.gz) = 6fcda8004bad0fb0eaee60e8308f91b605ad0dce SHA256 (openssh-10.2.tar.gz) = y0rCEdrVc4OJRZLg0u3F0frAgz87ydeTktCk3rQfVj8 SHA1 (openssh-10.2p1.tar.gz) = c34efade16109f065ec8c834f237bcedd8d7ef5c SHA256 (openssh-10.2p1.tar.gz) = zMQsBBmTeVkmP6Hb0W2vwYxWuYTANWLSk3zlamD3mLI Please note that the SHA256 signatures are base64 encoded and not hexadecimal (which is the default for most checksum tools). The PGP key used to sign the releases is available from the mirror sites: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc Reporting Bugs: ============== - Please read https://www.openssh.com/report.html Security bugs should be reported directly to openssh at openssh.com