Summary
[9.9p1-12.0.1]
- Upstream references found with /usr/bin/ssh [Orabug: 37824421]
[9.9p1-12]
- CVE-2025-61984: Reject usernames with control characters
Resolves: RHEL-128397
- CVE-2025-61985: Reject URL-strings with NULL characters
Resolves: RHEL-128387
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | openssh | 0:9.9p1-12.0.1.el10_1 |
| Oracle Linux · 10 | openssh-askpass | 0:9.9p1-12.0.1.el10_1 |
| Oracle Linux · 10 | openssh-clients | 0:9.9p1-12.0.1.el10_1 |
| Oracle Linux · 10 | openssh-keycat | 0:9.9p1-12.0.1.el10_1 |
| Oracle Linux · 10 | openssh-keysign | 0:9.9p1-12.0.1.el10_1 |
| Oracle Linux · 10 | openssh-server | 0:9.9p1-12.0.1.el10_1 |
Vulnerabilities 2
-
Low 3.6CVE-2025-61984 Public exploit
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted source…
-
Low 3.6
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a Pro…