Critical Security Flaw in OpenSSH Packages: Code Execution Risk
Summary
ALSA-2025:23480: Moderate: openssh security update. Affects openssh versions < 8.7p1-47.el9_7.alma.1. Fixed in 8.7p1-47.el9_7.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenSSH is a widely used implementation of the SSH protocol, providing secure communication over unsecured networks. It is essential for remote server management and file transfers. The affected packages include openssh, openssh-askpass, openssh-clients, openssh-keycat, openssh-server, and pam_ssh_agent_auth, all of which are integral to secure shell operations in various Linux distributions, including AlmaLinux.
Vulnerability Detail
The vulnerability arises from the handling of control characters in usernames and null characters in ssh:// URIs. Specifically, these issues can lead to code execution via ProxyCommand, allowing an attacker to execute arbitrary commands on the server. This poses a significant risk as it could lead to unauthorized access and control over the affected systems.
How To Fix
Minimum fixed version
8.7p1-47.el9_7.alma.1
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using ProxyCommand with usernames that contain control characters or null characters in ssh:// URIs until the packages can be updated.
Conclusion
The OpenSSH security update addresses critical vulnerabilities that could lead to code execution. It is crucial for users to update their packages promptly to mitigate these risks. Employing tools like Vulert can help in monitoring vulnerabilities effectively.
See every vulnerability recorded for openssh →
FAQ
The vulnerability allows for code execution through improperly handled control characters in usernames and null characters in ssh:// URIs.
The affected packages include openssh, openssh-askpass, openssh-clients, openssh-keycat, openssh-server, and pam_ssh_agent_auth.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
As a temporary measure, avoid using ProxyCommand with vulnerable inputs until you can apply the update.
Failure to address this vulnerability could result in unauthorized access and control over your systems, leading to data breaches and other security incidents.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
