Summary
[9.9p1-27.0.1]
- Upstream references found with /usr/bin/ssh [Orabug: 37824421]
[9.9p1-27]
- CVE-2026-73283: Complete the fix of security bypass due to incorrect
handling of forwarding and tunneling options
Resolves: RHEL-245413
- CVE-2026-73281: Fix misinteraction between agent locking and
the session-bind@openssh.com extension
Resolves: RHEL-245423
- CVE-2026-73282: Fix information disclosure and data corruption
via use-after-free in ssh client
Resolves: RHEL-245418
[9.9p1-26]
- Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded
file location
Resolves: RHEL-236314
- Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect
handling of forwarding and tunneling options
Resolves: RHEL-236288
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | openssh | 0:9.9p1-27.0.1.el10_2 |
| Oracle Linux · 10 | openssh-askpass | 0:9.9p1-27.0.1.el10_2 |
| Oracle Linux · 10 | openssh-clients | 0:9.9p1-27.0.1.el10_2 |
| Oracle Linux · 10 | openssh-keycat | 0:9.9p1-27.0.1.el10_2 |
| Oracle Linux · 10 | openssh-keysign | 0:9.9p1-27.0.1.el10_2 |
| Oracle Linux · 10 | openssh-server | 0:9.9p1-27.0.1.el10_2 |
Vulnerabilities 5
-
Medium 5.9
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did no…
-
Medium 4.8
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding opera…
-
Medium 4.2
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is …
-
Low 3.5
In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, includ…
-
Low 2.5
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwa…