Summary
[8.0p1-33.0.1]
- Update upstream references [Orabug: 36587718]
[8.0p1-33]
- CVE-2026-73282: Fix information disclosure and data corruption
via use-after-free in ssh client
Resolves: RHEL-248257
[8.0p1-32]
- Improve fix for CVE-2023-38408, avoid invoking constructors on dlopen()
Related: RHEL-234763
[8.0p1-31 + 0.10.3-8]
- CVE-2026-59995: Fix sftp download to server-controlled path when
performing download on the commandline
Resolves: RHEL-236324
- CVE-2026-59999: Fix DisableForwarding=yes not overriding
PermitTunnel=yes
Resolves: RHEL-236280
- Improve fix for CVE-2023-38408, avoid invoking constructors on dlopen()
Resolves: RHEL-234763
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | openssh | 0:8.0p1-33.0.1.el8_10 |
| Oracle Linux · 8 | openssh-askpass | 0:8.0p1-33.0.1.el8_10 |
| Oracle Linux · 8 | openssh-cavs | 0:8.0p1-33.0.1.el8_10 |
| Oracle Linux · 8 | openssh-clients | 0:8.0p1-33.0.1.el8_10 |
| Oracle Linux · 8 | openssh-keycat | 0:8.0p1-33.0.1.el8_10 |
| Oracle Linux · 8 | openssh-ldap | 0:8.0p1-33.0.1.el8_10 |
| Oracle Linux · 8 | openssh-server | 0:8.0p1-33.0.1.el8_10 |
| Oracle Linux · 8 | pam_ssh_agent_auth | 0:0.10.3-8.33.0.1.el8_10 |
Vulnerabilities 3
-
Medium 5.9
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did no…
-
Medium 4.8
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding opera…
-
Medium 4.2
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is …