Fun things to note: * ssh(1), sshd(8): Reduce the syslog level of some relatively common protocol events from LOG_CRIT. bz#2585 This will change the rep

Fun things to note: * ssh(1), sshd(8): Reduce the syslog level of some relatively common protocol events from LOG_CRIT. bz#2585 This will change the reporting of some systems' logs, which could result in different log reports. If you've ever wondered "why did we suddenly get 20% less critical alerts in August?", upgrading OpenSSH could be one reason. * sshd(8): Remove obsolete and misleading "POSSIBLE BREAK-IN ATTEMPT!" message when forward and reverse DNS don't match. bz#2585 Lol. Also, for programs/scripts designed to expect specific interactive warning messages, this could break them. As for the security fixes, the first means there's a potential DOS in older versions, the second means you could possibly detect valid accounts in old versions, and the fifth is a local attack that's viable in old versions: If PAM is configured to read user-specified environment variables and UseLogin=yes in sshd_config, then a hostile local user may attack /bin/login via LD_PRELOAD or similar environment variables set via PAM. Drop an LD_PRELOAD library in /tmp/, log in to the server passing the path to the library in the LD_PRELOAD variable, and PAM will load the library into the resulting login program. PAM then lets you run a root program with your own library functions. Fun stuff! (Also: I hate PAM)