Skip to content
OpenAdvisories
Low ALAS2-2026-3175 2 CVEs

Low: openssh security update (Amazon Linux 2)

Published Feb 16, 2026 · Updated Feb 20, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-61984: ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.) CVE-2025-32728: In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 openssh 0:7.4p1-22.amzn2.0.11
Amazon Linux · 2 openssh-askpass 0:7.4p1-22.amzn2.0.11
Amazon Linux · 2 openssh-cavs 0:7.4p1-22.amzn2.0.11
Amazon Linux · 2 openssh-clients 0:7.4p1-22.amzn2.0.11
Amazon Linux · 2 openssh-debuginfo 0:7.4p1-22.amzn2.0.11
Amazon Linux · 2 openssh-keycat 0:7.4p1-22.amzn2.0.11
Amazon Linux · 2 openssh-ldap 0:7.4p1-22.amzn2.0.11
Amazon Linux · 2 openssh-server 0:7.4p1-22.amzn2.0.11
Amazon Linux · 2 openssh-server-sysvinit 0:7.4p1-22.amzn2.0.11
Amazon Linux · 2 pam_ssh_agent_auth 0:0.10.3-2.22.amzn2.0.11

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-32728.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-61984.html