In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "openssh-client": "1:8.9p1-3ubuntu0.6", "ssh-askpass-gnome-dbgsym": "1:8.9p1-3ubuntu0.6", "openssh-tests": "1:8.9p1-3ubuntu0.6", "openssh-sftp-server-dbgsym": "1:8.9p1-3ubuntu0.6", "ssh-askpass-gnome": "1:8.9p1-3ubuntu0.6", "openssh-sftp-server": "1:8.9p1-3ubuntu0.6", "openssh-server": "1:8.9p1-3ubuntu0.6", "openssh-tests-dbgsym": "1:8.9p1-3ubuntu0.6", "openssh-server-dbgsym": "1:8.9p1-3ubuntu0.6", "ssh": "1:8.9p1-3ubuntu0.6", "openssh-client-dbgsym": "1:8.9p1-3ubuntu0.6" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "openssh-client": "1:9.6p1-3ubuntu1", "ssh-askpass-gnome-dbgsym": "1:9.6p1-3ubuntu1", "openssh-tests": "1:9.6p1-3ubuntu1", "openssh-sftp-server-dbgsym": "1:9.6p1-3ubuntu1", "ssh-askpass-gnome": "1:9.6p1-3ubuntu1", "openssh-sftp-server": "1:9.6p1-3ubuntu1", "openssh-server": "1:9.6p1-3ubuntu1", "openssh-tests-dbgsym": "1:9.6p1-3ubuntu1", "openssh-server-dbgsym": "1:9.6p1-3ubuntu1", "ssh": "1:9.6p1-3ubuntu1", "openssh-client-dbgsym": "1:9.6p1-3ubuntu1" } ] }