honk.any-key.press

undeadly rss

Feed: OpenBSD Journal
ronk: RSS-to-honk bot

undeadly honked 11 Nov 2026 19:00 +0000

The world moves on, and with it comes bugfixes and new releases. The LibresSSL project has announced the release of versions 4.3.5 and 4.4.1 , in an announcement that reads,

List:       openbsd-announce
Subject:    LibreSSL 4.3.5 and 4.4.1 released
From:       Brent Cook <busterb () gmail ! com>
Date:       2026-11-11 13:37:27
Message-ID: avRvlxkd6oW6QuJ2 () bobcat ! local

We have released LibreSSL 4.3.5 and 4.4.1, which will be arriving in the
LibreSSL directory of your local OpenBSD mirror soon.

undeadly honked 06 Nov 2026 11:00 +0000

OpenBSD top(1) adds flag to show chroot, pledge and unveil status

With one recent commit , the top(1) command on OpenBSD became quite a bit more useful. The commit adds a new -Q flag to show each process' use of the chroot(2) , pledge(2) and unveil(2) facilities.

The commit message reads,

List:       openbsd-cvs
Subject:    CVS: cvs.openbsd.org: src
From:       Klemens Nanni <kn () cvs ! openbsd ! org>
Date:       2026-11-05 17:54:16

CVSROOT:	/cvs
Module name:	src
Changes by:	kn@cvs.openbsd.org	2026/11/05 11:54:16

Modified files:
	usr.bin/top    : display.c machine.c machine.h top.1 top.c 

Log message:
add Q flag/key to show pledge/chroot/unveil usage

undeadly honked 05 Nov 2026 11:00 +0000

OpenSSH 10.6p2 released

In an announcement posted on social media, Damien Miller ( djm@ ) writes,

OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability.

If you operate a Linux system that uses musl libc without PAM (Alpine Linux is one example) then stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.

This vulnerability does not exist on non-Linux systems, Linux/glibc systems and Linux systems that use PAM for password authentication.

We consider the root cause of this bug to be outside OpenSSH itself, but we're in a good position to deliver a mitigation quickly.

Read more…