OpenSSH 10.6 was released, and FOSS Force highlights the note that longtime maintainer Damien Miller attached to the announcement on the openssh-unix-announce mailing list: the project has received a large number of security bug reports that are AI findings or were made with AI assistance, and while many have no security impact under a realistic threat model, the team very much welcomes them, especially when combined with human triage, analysis, test cases and proposed fixes. The stance contrasts with other projects that have complained about floods of AI-generated vulnerability reports. FOSS Force counts 11 security fixes in the release alongside many bugfixes and about a dozen new features, including extending the WarnWeakCrypto option from the client to both sides so it is on by default and logs whenever a key agreement scheme is not post-quantum safe, and a new restriction that disallows the dollar sign and backslash in usernames entered on the command line to avoid mischief from untrusted sources, which does not affect usernames set in configuration files.
OpenSSH 10.6 ships security fixes and a welcome mat for AI bug reports
OpenSSH 10.6 was released, and FOSS Force highlights the note that longtime maintainer Damien Miller attached to the announcement on the openssh-unix-announce mailing list: the project has received a large number of security bug reports that are AI findings or were made with AI assistance, and while many have no security impact under a realistic threat model, the team very much welcomes them, especially when combined with human triage, analysis, test cases and proposed fixes. The stance contrasts with other projects that have complained about floods of AI-generated vulnerability reports. FOSS Force counts 11 security fixes in the release alongside many bugfixes and about a dozen new features, including extending the WarnWeakCrypto option from the client to both sides so it is on by default and logs whenever a key agreement scheme is not post-quantum safe, and a new restriction that disallows the dollar sign and backslash in usernames entered on the command line to avoid mischief from untrusted sources, which does not affect usernames set in configuration files.
Source: FOSS Force