Critical Security Update for OpenSSH: Multiple Vulnerabilities Addressed
Summary
RLSA-2026:19069: Important: openssh security update. Affects openssh versions < 0:9.9p1-23.el10_2.rocky.0.1. Fixed in 0:9.9p1-23.el10_2.rocky.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH protocol, essential for secure communication over unsecured networks. It provides both client and server functionalities, allowing users to securely log into remote machines and transfer files. The package is integral to many Linux and UNIX-based systems, including Rocky Linux. However, recent vulnerabilities have been identified that could compromise system security if left unaddressed.
Vulnerability Detail
The vulnerabilities in OpenSSH include privilege escalation via the legacy SCP protocol, security bypass through mishandling of authorized_keys, information disclosure due to unintended cryptographic algorithm usage, low integrity impact from unconfirmed proxy-mode multiplexing sessions, and arbitrary command execution via shell metacharacters in usernames. These vulnerabilities can lead to unauthorized access, data leaks, and potential system compromise, making it crucial for users to apply the necessary updates.
How To Fix
Minimum fixed version
0:9.9p1-23.el10_2.rocky.0.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the use of the SCP legacy protocol and review their authorized_keys configurations to ensure that no insecure principals are set. However, applying the patch is the recommended solution.
Conclusion
The recent security update for OpenSSH addresses critical vulnerabilities that could compromise system security. It is essential for users to update to the latest patched version to protect against potential threats. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is an implementation of the SSH protocol that provides secure communication over unsecured networks, commonly used for remote login and file transfers.
The vulnerabilities include privilege escalation, security bypass, information disclosure, low integrity impact, and arbitrary command execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
The CVSS score for the vulnerabilities is 7.5, indicating a high level of severity.
If immediate updating is not possible, consider implementing temporary workarounds such as restricting the SCP legacy protocol and reviewing your authorized_keys configurations.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
