The OpenSSH project has announced OpenSSH 10.6p2, an urgent security update that addresses a critical password authentication bypass vulnerability on certain Linux systems.
According to the announcement, the issue affects Linux systems where OpenSSH is built and run with PAM support disabled. Importantly, the release notes specifically identify systems using musl libc with PAM disabled as affected.
The vulnerability can be exploited through the OpenSSH server daemon (sshd), potentially allowing attackers to bypass password authentication. The developers emphasize that the underlying cause is outside OpenSSH itself. Nevertheless, they have implemented a workaround in sshd to prevent exploitation.
Given the severity of the issue, administrators running affected configurations are advised to update as soon as packages become available through their distributions.
Apart from the security fix, OpenSSH 10.6p2 includes several improvements already committed to the project’s stable branch. Among them is support for the hybrid post-quantum signature algorithm ssh-mldsa44-ed25519 as an allowed CA signature algorithm.
The update also resolves a brief CPU spin lasting under one second when the ChannelTimeout option is enabled and corrects unexpected behavior when SIGINT or SIGQUIT signals interrupt passphrase entry in ssh, ssh-add, and ssh-keygen.
The OpenSSH developers have also announced a change in how they plan to handle security updates, citing an increasing number of vulnerability reports generated or assisted by artificial intelligence.
According to the team, while many AI-generated reports turn out to have no practical security impact, others identify legitimate vulnerabilities that are later independently discovered by different researchers.
The developers believe this suggests malicious actors may also be able to discover these issues without reporting them. Consequently, OpenSSH intends to publish security fixes more frequently instead of holding them until the next scheduled release.
Finally, OpenSSH 10.6p2 retains the previously announced deprecation of the scp command’s -R option, which performs remote-to-remote copies by executing scp on a remote host. Starting with OpenSSH 10.6, using this option produces a deprecation warning. A future release will ignore it and use the default behavior of transferring files through the local host.
