OpenSSH 10.5 Released, Embraces AI-Assisted Security Reports
OpenSSH 10.5/10.5p1
OpenSSH 10.5 is out, with security fixes and a notable shift: the team now welcomes AI-assisted bug reports, which have surged. They'll ship more frequent releases to get fixes out faster. Key changes include a fix for an ssh-agent locking bypass, a potential use-after-free in ssh, and stricter authorized_keys 'restrict' enforcement for tunnels. Also new: a 'ssh -Z' mode to preview authentication keys, and FIDO key preference tweaks.
We have seen a number of cases where a security bug identified by AI tools is subsequently independently discovered by a different researcher.
- alpn
"[..] a security bug identified by
AI tools is subsequently independently discovered by a different
researcher. This suggests that adversaries who do not report bugs
to OSS projects are likely to be able to discover these bugs too.
Given this, the OpenSSH team will, for now, be making more frequent
releases to get bugfixes into users' hands more quickly rather than
batching them until the next planned release."
- yjftsjthsd-h
> ssh(1): add a "ssh -Z user@host" mode that prints the keys that
will be tried for public key authentication in the order that
they will be used.
Oh, that's a nice new feature:)
- 4L3XV33
Glad they're not letting potential high false positive rate preclude discovery of true positives. Better to get a lot of noise with a little bit of signal, if the alternative was not get that signal at all.
- qudat
Darn, still no host headers so we can reverse proxy on a single ip
- 3asj176
No, AI assistance is NOT welcome in general. They mention security bug reports, so using AI like ASAN etc. is welcome.