Critical Security Flaw in OpenSSH: Multiple Vulnerabilities Identified
Summary
RLSA-2026:47757: Important: openssh security update. Affects openssh versions < 0:9.9p1-25.el10_2.rocky.0.1. Fixed in 0:9.9p1-25.el10_2.rocky.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH protocol, providing secure communication over unsecured networks. It is essential for remote server management and secure file transfers. The package is integral to various Linux and UNIX-based systems, including Rocky Linux. Recent vulnerabilities have been identified that could compromise the security of systems using OpenSSH, making it crucial for users to stay informed and updated.
Vulnerability Detail
The vulnerabilities in OpenSSH include a local MITM attack on X11 forwarding via abstract UNIX socket pre-binding, a double free issue during FIPS known-group validation leading to client-side denial of service, a heap out-of-bounds read due to missing NULL sentinel termination, a use-after-free vulnerability during host key re-exchange, and a file misplacement vulnerability during remote copy operations. These vulnerabilities can lead to unauthorized access, denial of service, and data integrity issues.
How To Fix
Minimum fixed version
0:9.9p1-25.el10_2.rocky.0.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable X11 forwarding and avoid using the affected features until the package is updated. This can be done by modifying the SSH configuration file (usually located at /etc/ssh/sshd_config) and setting 'X11Forwarding no'.
Conclusion
The recent vulnerabilities identified in OpenSSH pose significant risks to users and systems relying on this essential package. It is imperative to apply the necessary updates and follow best practices to mitigate potential threats.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is an open-source implementation of the SSH protocol, providing secure encrypted communications over a computer network.
The vulnerabilities can lead to unauthorized access, denial of service, and potential data breaches, compromising the security of systems.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.7, indicating a high level of severity.
It is recommended to regularly check for updates and apply them promptly to ensure your system remains secure against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
