Possible remote code execution due to a race condition (CVE-2024-6409)
45741

Possible remote code execution due to a race condition (CVE-2024-6387)
45348

Fix ssh multiplexing connect timeout processing
37748

Correctly audit hostname and IP address
22316
Make default key sizes configurable in sshd-keygen
26454

Use FIPS-compatible API for key derivation
32809

Fix Terrapin attack
2023-48795

Fix Terrapin attack
2023-48795

Fix Terrapin attack
2023-48795
Relax OpenSSH build-time checks for OpenSSL version
4734
Forbid shell metasymbols in username/hostname
2023-51385

Relax OpenSSH checks for OpenSSL version
4734
Limit artificial delays in sshd while login using AD user
2469
Move users/groups creation logic to sysusers.d fragments
5222

Avoid remote code execution in ssh-agent PKCS#11 support
2023-38408

Allow specifying validity interval in UTC

Fix pkcs11 issue with the recent changes
Delete unnecessary log messages from previous compl-dh patch
Add ssh_config man page explanation on rhbz#2068423
Resolves: rhbz#2207793, rhbz#2209096

Fix minor issues with openssh-8.7p1-evp-fips-compl-dh.patch:
Check return values
Use EVP API to get the size of DH
Add some log debug lines
Related: rhbz#2091694

Some non-terminating processes were listening on ports.
On sshd startup, we check whether signing using the SHA1 for signing is
On ssh private key conversion we explicitly use SHA2 for testing RSA keys.
In sshd, when SHA1 signatures are unavailable, we fallback (fall forward :) )
On a client side we permit SHA2-based proofs from server when requested SHA1
We fallback to SHA2 if SHA1 signatures is not available on the client side
We skip dss-related tests (they don't work without SHA1).
FIPS compliance efforts for dh, ecdh and signing

Resolve possible self-DoS with some clients

Do not try to use SHA1 for host key ownership proof when we don't support it server-side