Skip to content
OpenAdvisories
Medium ALSA-2023:2645 1 CVE

Moderate: openssh security update

Published May 9, 2023 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es):

* openssh: the functions order_hostkeyalgs() and list_hostkey_types() leads to double-free vulnerability (CVE-2023-25136)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 6

ReleasePackageFixed in
AlmaLinux · 9 openssh 8.7p1-29.el9_2
AlmaLinux · 9 openssh-askpass 8.7p1-29.el9_2
AlmaLinux · 9 openssh-clients 8.7p1-29.el9_2
AlmaLinux · 9 openssh-keycat 8.7p1-29.el9_2
AlmaLinux · 9 openssh-server 8.7p1-29.el9_2
AlmaLinux · 9 pam_ssh_agent_auth 0.10.4-5.29.el9_2

Vulnerabilities 1

  • Unscored —
    CVE-2023-25136 Public exploit EPSS 90%

    OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed …

    openssh openssh Debian Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2023-25136
  • report
    https://bugzilla.redhat.com/2167636
  • advisory
    https://errata.almalinux.org/9/ALSA-2023-2645.html