Summary
[9.9p1-25.0.1]
- Upstream references found with /usr/bin/ssh [Orabug: 37824421]
[9.9p1-25]
- CVE-2026-59996: Fix remote glob result of '..' causing files to be placed
in unintended parent directories when scp performs remote-to-remote copy
via the local host
Resolves: RHEL-193170
- CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange
Resolves: RHEL-193016
[9.9p1-24]
- CVE-2026-55653: Fix double free in openssh DH-GEX client path during
FIPS known-group validation that leads to client-side denial of service
Resolves: RHEL-186435
- CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator
cleanup due to missing NULL terminator
Resolves: RHEL-185826
- CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket
pre-binding
Resolves: RHEL-185852
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | openssh | 0:9.9p1-25.0.1.el10_2 |
| Oracle Linux · 10 | openssh-askpass | 0:9.9p1-25.0.1.el10_2 |
| Oracle Linux · 10 | openssh-clients | 0:9.9p1-25.0.1.el10_2 |
| Oracle Linux · 10 | openssh-keycat | 0:9.9p1-25.0.1.el10_2 |
| Oracle Linux · 10 | openssh-keysign | 0:9.9p1-25.0.1.el10_2 |
| Oracle Linux · 10 | openssh-server | 0:9.9p1-25.0.1.el10_2 |
Vulnerabilities 5
-
High 7.7
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This…
-
Medium 5.0
Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions
A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X …
-
Medium 4.3
Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service
A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the clie…
-
Medium 4.2
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs betwe…
-
Low 3.7
Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination
A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A…