Summary
[9.9p1-9.0.1]
- Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM/NIST backport [Orabug: 39423076]
- Upstream references found with /usr/bin/ssh [Orabug: 37814929]
[9.9p1-9]
- CVE-2026-59996: Fix remote glob result of '..' causing files to be placed
in unintended parent directories when scp performs remote-to-remote copy
via the local host
Resolves: RHEL-193178
- CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange
Resolves: RHEL-193024
[9.9p1-8]
- CVE-2026-55653: Fix double free in openssh DH-GEX client path during
FIPS known-group validation that leads to client-side denial of service
Resolves: RHEL-186439
- CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator
cleanup due to missing NULL terminator
Resolves: RHEL-185836
- CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket
pre-binding
Resolves: RHEL-185854
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | openssh | 0:9.9p1-9.0.1.el9_8 |
| Oracle Linux · 9 | openssh-askpass | 0:9.9p1-9.0.1.el9_8 |
| Oracle Linux · 9 | openssh-clients | 0:9.9p1-9.0.1.el9_8 |
| Oracle Linux · 9 | openssh-keycat | 0:9.9p1-9.0.1.el9_8 |
| Oracle Linux · 9 | openssh-server | 0:9.9p1-9.0.1.el9_8 |
| Oracle Linux · 9 | pam_ssh_agent_auth | 0:0.10.4-7.9.0.1.el9_8 |
Vulnerabilities 5
-
High 7.7
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This…
-
Medium 5.0
Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions
A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X …
-
Medium 4.3
Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service
A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the clie…
-
Medium 4.2
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs betwe…
-
Low 3.7
Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination
A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A…