Moderate Security Vulnerability in OpenSSH Packages: CVE-2025-32728
Summary
ALSA-2025:20126: Moderate: openssh security update. Affects openssh versions < 9.9p1-11.el10.alma.1. Fixed in 9.9p1-11.el10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenSSH is a widely used implementation of the SSH protocol, providing secure encrypted communications over a computer network. It is integral to many Linux and UNIX systems, offering both client and server functionalities. The package includes essential components such as SSHD, SSH clients, and related tools, making it a critical part of system security. However, vulnerabilities in OpenSSH can expose systems to various security risks, including unauthorized access and data breaches.
Vulnerability Detail
The vulnerability identified as CVE-2025-32728 affects the SSHD Agent Forwarding and X11 Forwarding features of OpenSSH. This flaw could allow an attacker to exploit the forwarding capabilities, potentially leading to unauthorized access to sensitive information or control over the affected system. The issue arises from improper handling of forwarded connections, which can be manipulated by malicious actors to gain elevated privileges or intercept data.
How To Fix
Minimum fixed version
9.9p1-11.el10.alma.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable SSH agent forwarding and X11 forwarding in their SSH configurations until the packages are updated. This can be done by modifying the SSH configuration file (usually located at /etc/ssh/sshd_config) and setting the following options:
AllowAgentForwarding no X11Forwarding no
After making these changes, restart the SSH service with:
sudo systemctl restart sshd
Conclusion
The OpenSSH vulnerability CVE-2025-32728 poses a moderate risk to systems using affected packages. It is crucial to update to the patched version to ensure security. Users should also consider temporary workarounds while preparing for the update.
See every vulnerability recorded for openssh →
FAQ
CVE-2025-32728 is a security vulnerability in OpenSSH that affects its SSHD Agent Forwarding and X11 Forwarding features, potentially allowing unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider disabling SSH agent forwarding and X11 forwarding as a temporary workaround.
Failing to address this vulnerability could lead to unauthorized access to your system, data breaches, and potential exploitation by malicious actors.
For more details, refer to the CVE page associated with CVE-2025-32728 and the AlmaLinux Release Notes linked in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
