Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 7

Vulnerabilities 8

• High 7.7
  CVE-2026-60002

  ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This…

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux Alpine
  Jul 8, 2026
• Medium 6.5
  CVE-2026-60001

  sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux Alpine
  Jul 8, 2026
• Medium 5.9
  CVE-2026-59999

  In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did no…

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux Alpine
  Jul 8, 2026
• Medium 4.8
  CVE-2026-59998

  sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if t…

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux Alpine
  Jul 8, 2026
• Medium 4.2
  CVE-2026-59995

  sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is …

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux Alpine
  Jul 8, 2026
• Medium 4.2
  CVE-2026-59996

  scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs betwe…

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux Alpine
  Jul 8, 2026
• Medium 4.2
  CVE-2026-59997

  internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important…

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux Alpine
  Jul 8, 2026
• Low 3.7
  CVE-2026-60000

  sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive a…

  OpenBSD OpenSSH openssh openssh Debian Ubuntu Azure Linux Alpine
  Jul 8, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-59996
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-59998
• report
  https://access.redhat.com/security/cve/CVE-2026-60001
• report
  https://access.redhat.com/security/cve/CVE-2026-60002
• report
  https://access.redhat.com/security/cve/CVE-2026-59995
• report
  https://access.redhat.com/security/cve/CVE-2026-59999
• report
  https://access.redhat.com/security/cve/CVE-2026-59997
• report
  https://access.redhat.com/security/cve/CVE-2026-60000
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37382.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497927
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59995
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59995
• article
  https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2
• article
  https://www.openssh.org/releasenotes.html#10.4p1
• article
  https://www.openwall.com/lists/oss-security/2026/07/06/5
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497944
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59996
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59996
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497929
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59997
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59997
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497935
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59998
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59998
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497942
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59999
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59999
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497946
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-60000
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-60000
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497938
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-60001
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-60001
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497936
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-60002
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-60002