Summary
[8.7p1-47.0.1]
- Upstream references found with /usr/bin/ssh [Orabug: 37814929]
- upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064]
- Update upstream references [Orabug: 36564626]
[8.7p1-47]
- CVE-2025-61984: Reject usernames with control characters
Resolves: RHEL-128401
- CVE-2025-61985: Reject URL-strings with NULL characters
Resolves: RHEL-128392
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | openssh | 0:8.7p1-47.0.1.el9_7 |
| Oracle Linux · 9 | openssh-askpass | 0:8.7p1-47.0.1.el9_7 |
| Oracle Linux · 9 | openssh-clients | 0:8.7p1-47.0.1.el9_7 |
| Oracle Linux · 9 | openssh-keycat | 0:8.7p1-47.0.1.el9_7 |
| Oracle Linux · 9 | openssh-server | 0:8.7p1-47.0.1.el9_7 |
| Oracle Linux · 9 | pam_ssh_agent_auth | 0:0.10.4-5.47.0.1.el9_7 |
Vulnerabilities 2
-
Low 3.6CVE-2025-61984 Public exploit
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted source…
-
Low 3.6
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a Pro…