OpenSSH 10.3 Released With Patch for Shell Injection and Other Security Flaws

the OpenSSH project released version 10.3 alongside its portable version 10.3p1. Following a brief testing phase in late March, this major update addresses several important security vulnerabilities.

The most critical fix prevents a dangerous shell injection flaw, making this an essential update for system administrators worldwide.

OpenSSH remains the leading implementation of the SSH protocol 2.0, providing secure encrypted communications.

The primary focus of this release is a shell injection vulnerability found in the SSH client.

Previously, malicious user names passed via the command line could execute arbitrary shell commands when specific tokens, like “%u”, were used in configuration files.

OpenSSH 10.3 fixes this by adding stricter validation rules for shell characters. However, developers still strongly advise against directly exposing SSH command-lines to untrusted input.

Other notable security fixes include:

• Certificate Authentication Bug: Fixed a flaw in the server (sshd) where certificates containing comma-separated names could bypass certain restrictions in the authorized_keys file.
• Legacy SCP Permissions: Addressed a long-standing bug in legacy scp where downloading files as root failed to clear dangerous setuid/setgid permission bits.
• ECDSA Key Enforcement: Resolved an issue where restricting an ECDSA key to a specific algorithm accidentally allowed any other ECDSA algorithm to be accepted instead.

Key Features and Improvements

Beyond security patches, OpenSSH 10.3 introduces several helpful features for administrators to manage connections and prevent abuse:

• Connection Insights: New commands (such as ~I and ssh -Oconninfo) allow users to quickly view detailed information about their active SSH connections and open channels.
• Stronger Anti-Spam Penalties: The server now includes an ‘invaliduser’ penalty to automatically slow down automated bots and attackers trying to log in with fake usernames.
• Multiple Revocation Files: Administrators can now list multiple files in the RevokedHostKeys and RevokedKeys configurations to better manage compromised keys.
• Standardized Agent Forwarding: Added support for official IANA-assigned names for SSH agent forwarding, improving overall compatibility.
• Sub-Second Penalties: The PerSourcePenalties feature now supports decimal times, allowing for defensive blocks that last less than a single second.

Administrators should be aware of a few changes that might break older network setups. OpenSSH 10.3 officially drops compatibility for older, insecure software implementations that do not support cryptographic rekeying.

Furthermore, the ProxyJump command-line option now strictly validates hostnames and usernames to block further shell injection risks.

Finally, an empty “principals” section in a certificate no longer acts as a wildcard; it now strictly matches nothing.

Organizations are advised to upgrade their servers and clients to OpenSSH 10.3 promptly to secure their infrastructure against these newly disclosed vulnerabilities.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.