Critical Security Flaw in OpenSSH Packages: Code Execution Risk via ProxyCommand
Summary
ALSA-2025:23479: Moderate: openssh security update. Affects openssh versions < 9.9p1-12.el10_1.alma.1. Fixed in 9.9p1-12.el10_1.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH (Secure Shell) protocol, essential for secure remote login and file transfers across various operating systems, including Linux and UNIX. It provides both client and server functionalities, enabling secure communications over unsecured networks. The OpenSSH suite includes several components, such as the SSH server, client, and related tools, which are integral for maintaining secure connections. However, recent vulnerabilities have exposed potential risks associated with control characters and null characters in usernames and URIs, respectively, leading to severe security concerns.
Vulnerability Detail
The vulnerabilities identified in OpenSSH (CVE-2025-61984 and CVE-2025-61985) stem from improper handling of control characters in usernames and null characters in ssh:// URIs. These flaws can be exploited through the ProxyCommand feature, allowing attackers to execute arbitrary code on the affected systems. This could lead to unauthorized access, data breaches, and compromise of sensitive information, making it critical for users to address these vulnerabilities promptly.
How To Fix
Minimum fixed version
9.9p1-12.el10_1.alma.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using ProxyCommand with usernames that contain control characters or null characters in ssh:// URIs until the packages are updated. This may help reduce the risk of exploitation until a proper fix is applied.
Conclusion
The identified vulnerabilities in OpenSSH pose significant risks to users, allowing for potential code execution through improper handling of usernames and URIs. It is crucial to update to the patched version to safeguard against these threats. Users are encouraged to utilize tools like Vulert for real-time monitoring of open-source vulnerabilities in their applications.
See every vulnerability recorded for openssh →
FAQ
The vulnerabilities involve control characters in usernames and null characters in ssh:// URIs, which can lead to code execution via ProxyCommand.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
Exploitation of these vulnerabilities can lead to unauthorized code execution, potentially compromising the security of the affected systems.
Yes, a patch is available in version 9.9p1-12.el10_1.alma.1 of the OpenSSH packages.
As a temporary measure, avoid using ProxyCommand with vulnerable usernames or URIs until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
