Critical Security Flaw in OpenSSH: Multiple Vulnerabilities Identified
Summary
RLSA-2026:69129: Important: openssh security update. Affects openssh versions < 0:9.9p1-27.el10_2.rocky.0.1. Fixed in 0:9.9p1-27.el10_2.rocky.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH (Secure Shell) protocol, which provides secure communication over unsecured networks. It is essential for secure remote login and file transfers across various operating systems, including Linux and UNIX. The package includes both client and server components, making it a critical tool for system administrators and users alike. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing OpenSSH.
Vulnerability Detail
The vulnerabilities in OpenSSH stem from various issues, including improper handling of file locations by the SFTP client, security bypasses due to incorrect forwarding and tunneling options, and a use-after-free condition in the SSH client. These vulnerabilities could allow attackers to control file downloads, bypass security restrictions, execute local operations remotely, and potentially disclose sensitive information or corrupt data. The CVSS score for these vulnerabilities is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
0:9.9p1-27.el10_2.rocky.0.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict the use of SFTP and SSH tunneling options until the package is updated. This can be done by modifying the SSH configuration file, typically located at '/etc/ssh/sshd_config', to disable specific features that are vulnerable.
Conclusion
The identified vulnerabilities in OpenSSH pose significant risks to system security. It is crucial for users to update their installations to the latest patched version to mitigate these risks. By following the provided steps and utilizing tools like Vulert, users can ensure their systems remain secure against potential threats.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is an open-source implementation of the SSH protocol, providing secure communication for remote logins and file transfers.
The vulnerabilities include issues with the SFTP client, security bypasses, tunnel forwarding restrictions, and a use-after-free condition in the SSH client.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
As a workaround, you can restrict the use of vulnerable features in the SSH configuration file until you are able to apply the update.
The CVSS score for these vulnerabilities is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
