OpenSSH 9.6 Mitigates the Terrapin Attack

A security-focused release

OpenSSH 9.6 was released on December 18, 2023, containing several security fixes alongside small features and bugfixes. The most significant addressed a newly discovered weakness in the SSH transport protocol itself.

The Terrapin attack and strict KEX

OpenSSH 9.6 implemented protocol extensions to thwart the Terrapin attack, discovered by Fabian Baumer, Marcus Brinkmann and Jorg Schwenk, in which a man-in-the-middle can effect a limited break of the early encrypted transport's integrity by injecting messages before encryption and deleting an equal number afterward. The project noted the impact was very limited, its most serious effect being deletion of the SSH2_MSG_EXT_INFO message to disable some keystroke-timing obfuscation. The fix, a new 'strict KEX' extension enabled automatically when both peers support it, terminates the connection on any unexpected message during key exchange and resets the MAC counter after each key exchange.

A command-injection countermeasure

The release also hardened ssh against command injection: if an invalid user or hostname containing shell metacharacters was passed and referenced via %u or %h in a ProxyCommand, LocalCommand or 'match exec' directive, an attacker could potentially inject commands, a risk illustrated by git submodules with hostile hostnames. OpenSSH 9.6 now bans most shell metacharacters from user and hostnames supplied on the command line, while leaving ssh_config-supplied names unrestricted.

Other fixes and features

OpenSSH 9.6 fixed a ssh-agent issue where destination constraints were only applied to the first of multiple PKCS#11 keys, added a %j token expanding to the ProxyJump hostname, brought ChannelTimeout to the client, and added support for reading Ed25519 private keys in PEM PKCS8 format. It also began terminating connections when a peer exceeds the RFC 4254 channel window by more than a small grace factor.

Related on Skillo

See also: OpenSSH 9.5 and keystroke timing obfuscation, OpenSSH 9.8 and the sshd race-condition fix.

Sources

• OpenSSH 9.6 release notes (openssh.com)

Published date reflects the original event date (2023-12-18). This article is original Skillo editorial written from the sources above; facts were verified in September 2026.