Summary
[8.0p1-27.0.1]
- Update upstream references [Orabug: 36587718]
[8.0p1-27]
- CVE-2025-61984: Reject usernames with control characters
Resolves: RHEL-128400
- CVE-2025-61985: Reject URL-strings with NULL characters
Resolves: RHEL-128390
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | openssh | 0:8.0p1-27.0.1.el8_10 |
| Oracle Linux · 8 | openssh-askpass | 0:8.0p1-27.0.1.el8_10 |
| Oracle Linux · 8 | openssh-cavs | 0:8.0p1-27.0.1.el8_10 |
| Oracle Linux · 8 | openssh-clients | 0:8.0p1-27.0.1.el8_10 |
| Oracle Linux · 8 | openssh-keycat | 0:8.0p1-27.0.1.el8_10 |
| Oracle Linux · 8 | openssh-ldap | 0:8.0p1-27.0.1.el8_10 |
| Oracle Linux · 8 | openssh-server | 0:8.0p1-27.0.1.el8_10 |
| Oracle Linux · 8 | pam_ssh_agent_auth | 0:0.10.3-7.27.0.1.el8_10 |
Vulnerabilities 2
-
Low 3.6CVE-2025-61984 Public exploit
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted source…
-
Low 3.6
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a Pro…