OpenSSH for Mac

Bugfixes

• Sshd(8): make IPQoS first-match-wins in sshd_config, like other configuration directives. bz3924
• Sshd(8): fix potential crash when Maxstartups is using a single argument (i.e. not using the Maxstartups x:y:z form) to a value below 10. bz3941
• Sshd(8): fix a potential hang during key exchange if needed DH group values were missing from /etc/moduli.
• Ssh-agent(1): fix return values from extensions to be correct wrt draft-ietf-sshm-ssh-agent: extension requests should indicate failure using SSH_AGENT_EXTENSION_FAILURE rather than the generic SSH_AGENT_FAILURE error code. This allows the client to discern between "the request failed" and "the agent doesn't support this extension".
• Ssh(1): use fmprintf for showing challenge-response name and info to preserve UTF-8 characters where appropriate. Prompted by GitHub PR#452.
• Scp(1): when uploading a directory using sftp/sftp (e.g. during a recursive transfer), don't clobber the remote directory permissions unless either we created the directory during the transfer or the -p flag was set. bz3925
• All: implement missing pieces of FIDO/webauthn signature support, mostly related to certificate handling and enable acceptance of this signature format by default. bz3748 GHPR624 GHPR625
• Sshd_config(5): make it clear that Denyusers/Denygroups overrides Allowusers/Allowgroups. Previously we specified the order in which the directives are processed but it was ambiguous as to what happened if both matched.
• Ssh(1): don't try to match certificates held in an agent to private keys. This matching is done to support certificates that were loaded without their private key material, but is unnecessary for agent-hosted certificate which always have private key material available in the agent. Worse, this matching would mess up the request sent to the agent in such a way as to break usage of these keys when the key usage was restricted in the agent. bz3752

Full list of changes available here