Package: openssh-server Version: 1:9.2p1-2+deb12u4 Severity: normal Dear Maintainer,
Debian's openssh-server and it's PAM configuration in /etc/pam.d/sshd has deprecated reading of user environment enabled. PAM_ENV(8) man page tells that "user supplied environment variables in the PAM environment could affect behavior of subsequent modules in the stack without the consent of the system administrator.", which sounds like this could even be a security issue. Please remove reading of the user environment (user_readenv=1 parameter) from /etc/pam.d/sshd -- System Information: Debian Release: 12.9 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: arm64 (aarch64) Foreign Architectures: armhf Kernel: Linux 6.6.51+rpt-rpi-2712 (SMP w/4 CPU threads; PREEMPT) Kernel taint flags: TAINT_CRAP Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8), LANGUAGE=en_US.UTF-8 Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages openssh-server depends on: ii adduser 3.134 ii debconf [debconf-2.0] 1.5.82 ii init-system-helpers 1.65.2 ii libaudit1 1:3.0.9-1 ii libc6 2.36-9+rpt2+deb12u9 ii libcom-err2 1.47.0-2 ii libcrypt1 1:4.4.33-2 ii libgssapi-krb5-2 1.20.1-2+deb12u2 ii libkrb5-3 1.20.1-2+deb12u2 ii libpam-modules 1.5.2-6+rpt2+deb12u1 ii libpam-runtime 1.5.2-6+rpt2+deb12u1 ii libpam0g 1.5.2-6+rpt2+deb12u1 ii libselinux1 3.4-1+b6 ii libssl3 3.0.15-1~deb12u1+rpt1 ii libsystemd0 252.33-1~deb12u1 ii libwrap0 7.6.q-32 ii openssh-client 1:9.2p1-2+deb12u4 ii openssh-sftp-server 1:9.2p1-2+deb12u4 ii procps 2:4.0.2-3 ii runit-helper 2.15.2 ii sysvinit-utils [lsb-base] 3.06-4 ii ucf 3.0043+nmu1+deb12u1 ii zlib1g 1:1.2.13.dfsg-1+rpt1 Versions of packages openssh-server recommends: ii libpam-systemd [logind] 252.33-1~deb12u1 ii ncurses-term 6.4-4 ii xauth 1:1.1.2-1 Versions of packages openssh-server suggests: pn molly-guard <none> pn monkeysphere <none> pn ssh-askpass <none> pn ufw <none> -- Configuration Files: /etc/pam.d/sshd changed [not included] /etc/ssh/moduli changed [not included] -- debconf-show failed
