Critical Security Update for OpenSSH: Privilege Escalation and Bypass Vulnerabilities
Summary
ALSA-2026:13381: Important: openssh security update. Affects openssh versions < 8.7p1-49.el9_7.alma.1. Fixed in 8.7p1-49.el9_7.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH protocol, providing secure communication over unsecured networks. It includes essential components for both the OpenSSH client and server, enabling secure file transfers and remote command execution. However, recent vulnerabilities have been identified that could compromise the integrity and security of systems using OpenSSH.
Vulnerability Detail
The vulnerabilities in OpenSSH include privilege escalation via the legacy SCP protocol when file modes are not preserved, security bypass due to mishandling of the authorized_keys principals option, information disclosure from unintended cryptographic algorithm usage, low integrity impact from unconfirmed proxy-mode multiplexing sessions, and arbitrary command execution through shell metacharacters in usernames. These vulnerabilities could allow attackers to gain unauthorized access, execute arbitrary commands, or disclose sensitive information.
How To Fix
Minimum fixed version
8.7p1-49.el9_7.alma.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of the SCP legacy protocol and ensure proper configuration of the authorized_keys file to mitigate potential exploitation until the update is applied.
Conclusion
The recent vulnerabilities in OpenSSH pose significant risks to system security, including potential privilege escalation and unauthorized command execution. It is crucial to apply the recommended updates to mitigate these risks effectively. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities in your software.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is an open-source implementation of the SSH protocol, providing secure remote access and file transfer capabilities.
The vulnerabilities include privilege escalation, security bypass, information disclosure, low integrity impact, and arbitrary command execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If immediate updates are not possible, consider limiting the use of the SCP legacy protocol and reviewing your authorized_keys configurations as a temporary workaround.
It is recommended to regularly check for vulnerabilities, especially after major updates or when new vulnerabilities are disclosed.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
