Announcing MCP Toolbox Java SDK v1.0: Agentic data access for the enterprise
cloud.google.com·6d ago
Cloud & Infrastructure
The New Stack·5d ago·5 min read
OpenSSH 10.6 deliberately breaks two features in the name of security
TL;DR
OpenSSH 10.6 introduces significant security changes by disabling the LZ77 compression method and rejecting certain shell metacharacters in usernames, despite potential disruptions. These updates aim to mitigate vulnerabilities exposed by recent security research.
✦ Why It Matters
Review and update any automated scripts that use SSH to ensure compatibility with the new username restrictions.
Key Takeaways
- Disable LZ77 compression to prevent plaintext leaks.
- Update scripts to avoid using $ and \ in usernames.
- Monitor for more frequent OpenSSH security updates.
- Consider handling compression at the application layer.
How It Works
The LZ77 compression method was disabled because it shared a compression state across multiple channels, allowing attackers to exploit this shared context to recover plaintext data. By removing this feature, OpenSSH mitigates the risk of information leakage during SSH sessions.