Critical Security Update for OpenSSH: Multiple Vulnerabilities Addressed
Summary
ALSA-2026:69130: Important: openssh security update. Affects openssh versions < 9.9p1-11.el9_8.alma.1. Fixed in 9.9p1-11.el9_8.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH (Secure Shell) protocol, which provides secure communication over unsecured networks. It is essential for remote server management and secure file transfers. The package includes both the OpenSSH client and server components, making it versatile for various operating systems, including Linux and UNIX. However, recent vulnerabilities have been identified that could compromise the security of systems using OpenSSH.
Vulnerability Detail
The vulnerabilities in OpenSSH include a range of issues such as the sftp client allowing attackers to control the downloaded file location, security bypasses due to incorrect handling of forwarding and tunneling options, and a remote execution capability of local operations via ssh-agent. Additionally, there are risks of information disclosure and data corruption due to a use-after-free condition in the ssh client. These vulnerabilities could lead to unauthorized access, data loss, or system compromise.
How To Fix
Minimum fixed version
9.9p1-11.el9_8.alma.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of the affected features, such as disabling sftp or restricting the use of ssh-agent until the packages are updated. However, this is not a permanent solution and should only be used until the update can be applied.
Conclusion
The recent vulnerabilities identified in OpenSSH pose serious security risks that can affect the integrity and confidentiality of systems. It is essential to apply the recommended updates promptly to mitigate these risks and ensure secure operations.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is an open-source implementation of the SSH protocol, providing secure encrypted communications over a computer network.
The vulnerabilities could allow unauthorized access to systems, data corruption, and potential remote execution of commands, posing significant security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Yes, you can disable the affected features such as sftp or restrict the use of ssh-agent until the packages are updated.
For detailed information, refer to the CVE pages linked in the advisory, which provide insights into the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
