EV-684995-01-openssh-changelog

Terminal evidence file for QSA audit. Timestamps in UTC.

=== Terminal Evidence 684995-01 — OpenSSH backport patch verification ===
Timestamp: 2026-08-01T16:05:17Z

--- Droplet: fintrix-vpn-gateway (146.190.69.141) ---
$ ssh -V
OpenSSH_9.6p1 Ubuntu-3ubuntu13.18, OpenSSL 3.0.13 30 Jan 2024

$ dpkg -l openssh-server | tail -1
ii  openssh-server 1:9.6p1-3ubuntu13.18 amd64        secure shell (SSH) server, for secure access from remote machines

$ apt-get changelog openssh-server 2>&1 | grep -iE 'CVE-2024' | head -5
    - debian/patches/CVE-2024-39894.patch: don't rely on
    - CVE-2024-39894
    - debian/patches/CVE-2024-6387.patch: don't log in sshsigdie() in log.c.
    - CVE-2024-6387
  * No-change rebuild for CVE-2024-3094

--- Droplet: fintrix-production-collector (134.209.213.133) ---
$ ssh -V
OpenSSH_9.6p1 Ubuntu-3ubuntu13.18, OpenSSL 3.0.13 30 Jan 2024

$ dpkg -l openssh-server | tail -1
ii  openssh-server 1:9.6p1-3ubuntu13.18 amd64        secure shell (SSH) server, for secure access from remote machines

$ apt-get changelog openssh-server 2>&1 | grep -iE 'CVE-2024' | head -5
    - debian/patches/CVE-2024-39894.patch: don't rely on
    - CVE-2024-39894
    - debian/patches/CVE-2024-6387.patch: don't log in sshsigdie() in log.c.
    - CVE-2024-6387
  * No-change rebuild for CVE-2024-3094

---

Auto-generated evidence — do not edit. Regenerable via commands documented in the parent QSA response ticket.