* Backport from upstream:

  - Do not fall back to adding keys without contraints (ssh-add -c / -t
    ...) when the agent refuses the constrained add request. This was a
    useful migration measure back in 2002 when constraints were new, but
    just adds risk now (LP: #209447).

1 files changed, 5 insertions, 0 deletions

diff --git a/debian/changelog b/debian/changelog
index 8ff7c54ac..ed90f6561 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,6 +3,11 @@ openssh (1:5.3p1-1) UNRELEASED; urgency=low
   * New upstream release.
   * Update to GSSAPI patch from
     http://www.sxw.org.uk/computing/patches/openssh-5.3p1-gsskex-all-20100124.patch.
+  * Backport from upstream:
+    - Do not fall back to adding keys without contraints (ssh-add -c / -t
+      ...) when the agent refuses the constrained add request. This was a
+      useful migration measure back in 2002 when constraints were new, but
+      just adds risk now (LP: #209447).
 
  -- Colin Watson <cjwatson@debian.org>  Sun, 24 Jan 2010 22:32:25 +0000