Summary
USN-8222-1 fixed a vulnerability in OpenSSH. This update provides the
corresponding fix for Ubuntu 16.04 LTS.
Original advisory details:
Vladimir Tokarev discovered that OpenSSH incorrectly handled certificates
with the principal name containing a comma character when using user-trusted
CA keys in authorized_keys and an authorized_keys principals="" option
that lists more than one principal. This could result in inappropriate
principal matching, contrary to expectations. (CVE-2026-35414)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | openssh | 1:7.2p2-4ubuntu2.10+esm9 |
Vulnerabilities 1
-
Medium 4.2CVE-2026-35414 Public exploit
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list …
References
-
report
https://ubuntu.com/security/CVE-2026-35414