Moderate Security Vulnerability in OpenSSH: Code Execution Risks via ProxyCommand
Summary
ALSA-2025:23481: Moderate: openssh security update. Affects openssh versions < 8.0p1-27.el8_10. Fixed in 8.0p1-27.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH (Secure Shell) protocol, providing secure communication over unsecured networks. It is essential for remote server management and secure file transfers. OpenSSH includes both client and server components, making it a critical tool for system administrators and developers. However, recent vulnerabilities have been identified that could allow malicious actors to exploit certain features, leading to potential code execution risks.
Vulnerability Detail
The vulnerability arises from the handling of control characters in usernames and null characters in ssh:// URIs within the OpenSSH implementation. Specifically, these issues can be exploited through the ProxyCommand feature, which allows users to specify a command to connect to the server. If an attacker can manipulate the username or URI, they may execute arbitrary code on the server, leading to severe security breaches.
How To Fix
Minimum fixed version
8.0p1-27.el8_10
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using ProxyCommand with usernames or URIs that contain control characters or null characters until the packages are updated.
Conclusion
In summary, the identified vulnerabilities in OpenSSH pose significant security risks that can lead to code execution through manipulated usernames and URIs. It is crucial for users to update their packages to the latest patched versions to mitigate these risks. Temporary workarounds can be employed until updates are feasible.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is an open-source implementation of the SSH protocol, providing secure encrypted communications over a computer network.
The risks include potential unauthorized code execution on the server, which could lead to data breaches or system compromises.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, avoid using ProxyCommand with vulnerable usernames or URIs as a temporary workaround.
More details can be found on the CVE pages linked in the advisory, specifically CVE-2025-61984 and CVE-2025-61985.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
