Description of the patch:
This update for apache-sshd fixes the following issues:
Update to upstream version 2.19.0.
Security issues fixed:
- CVE-2026-56452: remote users can use SCP to send filenames that lead to arbitrary file writes due to a path traversal
issue in the
sshd-scp component of Apache MINA SSHD. (bsc#1272158).
- CVE-2026-56623: remote users can obtain access to git repositories outside of the configured server-side root
directory on Windows systems due to path traversal issue in
org.apache.sshd:sshd-git (bsc#1271993).
- CVE-2026-56624: users can authenticate with certificates containing the
force-command option but still execute
other commands due to improper validation of certificate options in Apache MINA SSHD (bsc#1271992).
- CVE-2026-58624: remote execution of JGit commands can lead to arbitrary file writes due to improper input validation
in
sshd-git of Apache MINA SSHD (bsc#1271991).
Other updates and bugfixes:
- Version 2.19.0:
- Bug Fixes
- GH-899 Fix ProcessShellFactory on Linux.
- GH-902 Fix client-side handling of sk-* public key signatures (also in the agent interfaces).
- Limit size of decompressed SSH packets.
- Improve checking SSH user certificates in public-key authentication.
- Improve handling of repository paths in sshd-git on Windows.
- Validate file names in SCP.
- Escape newlines in filenames in the SCP protocol.
- Restrict JGit commands accessible via GitPgmCommandFactory in sshd-git.