Package "openssh"
| Name: |
openssh
|
Description: |
This package is just an umbrella for a group of other packages,
it has no description.
Description samples from packages in group:
- OpenSSH regression tests
- interactive X program to prompt users for a passphrase for ssh-add
|
| Latest version: |
1:8.9p1-3ubuntu0.16 |
| Release: |
jammy (22.04) |
| Level: |
security |
| Repository: |
universe |
Links
Other versions of "openssh" in Jammy
Packages in group
Deleted packages are displayed in grey.
Changelog
|
openssh (1:8.9p1-3ubuntu0.16) jammy-security; urgency=medium
* SECURITY UPDATE: sftp downloaded files location issue
- debian/patches/CVE-2026-59995.patch: upstream: avoid download to server-
controlled path when performing in sftp.c.
- CVE-2026-59995
* SECURITY UPDATE: scp parent directory issue
- debian/patches/CVE-2026-59996.patch: upstream: resist that return ".." via
remote glob during in scp.c.
- CVE-2026-59996
* SECURITY UPDATE: internal-sftp ignores more than 9 commandline args
- debian/patches/CVE-2026-59997.patch: upstream: pass >9 commandline
arguments to the internal-sftp server, in session.c.
- CVE-2026-59997
* SECURITY UPDATE: undocumented GSSAPIStrictAcceptorCheck behaviour
- debian/patches/CVE-2026-59998.patch: upstream: mention a caveat regarding
GSSAPIStrictAcceptorCheck in in sshd_config.5.
- CVE-2026-59998
* SECURITY UPDATE: DisableForwarding=yes not taking proper precedence
- debian/patches/CVE-2026-59999.patch: upstream: DisableForwarding=yes
didn't override PermitTunnel=yes in serverloop.c.
- CVE-2026-59999
* SECURITY UPDATE: DoS via MaxAuthTries mishandling
- debian/patches/CVE-2026-60000-1.patch: upstream: Fix multiple RFC 4462
(GSSAPIAuthentication) compliance in auth2-gss.c.
- debian/patches/CVE-2026-60000-2.patch: upstream: unused variables in
auth2-gss.c.
- CVE-2026-60000
* SECURITY UPDATE: minimum authentication delay not always honoured
- debian/patches/CVE-2026-60001.patch: upstream: Fix cases in GSSAPI and
keyboard-interactive in auth.h, auth2-chall.c, auth2-gss.c, auth2.c.
- CVE-2026-60001
* SECURITY UPDATE: Use-after-free during a key re-exchange
- debian/patches/CVE-2026-60002.patch: upstream: fix ownership and lifetime
of several bits of client in ssh.c, sshconnect.c, sshconnect.h,
sshconnect2.c.
- CVE-2026-60002
-- Marc Deslauriers <email address hidden> Thu, 09 Jul 2026 14:38:00 -0400
|
| Source diff to previous version |
| CVE-2026-59995 |
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controll |
| CVE-2026-59996 |
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations. |
| CVE-2026-59997 |
internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argum |
| CVE-2026-59998 |
sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active |
| CVE-2026-59999 |
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not. |
| CVE-2026-60000 |
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) becaus |
| CVE-2026-60001 |
sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay. |
| CVE-2026-60002 |
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the cl |
|
|
openssh (1:8.9p1-3ubuntu0.15) jammy-security; urgency=medium
* SECURITY UPDATE: unexpected scp setuid and setgid
- debian/patches/CVE-2026-35385.patch: clear setuid/setgid bits from
downloaded files in scp.c.
- CVE-2026-35385
* SECURITY UPDATE: command execution via shell metacharacters in username
- debian/patches/CVE-2026-35386-pre1.patch: apply validity rules on
ProxyJump usernames and hostnames in readconf.c, readconf.h, ssh.c.
- debian/patches/CVE-2026-35386.patch: move username check earlier in
ssh.c.
- CVE-2026-35386
* SECURITY UPDATE: use of unintended ECDSA algorithms
- debian/patches/CVE-2026-35387_35414.patch: correctly match ECDSA
signature algorithms against algorithm allowlists in
auth2-hostbased.c, auth2-pubkey.c, sshconnect2.c.
- CVE-2026-35387
* SECURITY UPDATE: missing connection multiplexing confirmation
- debian/patches/CVE-2026-35388.patch: add missing askpass check in
mux.c.
- CVE-2026-35388
* SECURITY UPDATE: authorized_keys principals option mishandling
- debian/patches/CVE-2026-35387_35414.patch: check for commas in
auth2-pubkey.c.
- CVE-2026-35414
-- Marc Deslauriers <email address hidden> Mon, 27 Apr 2026 20:38:10 -0400
|
| Source diff to previous version |
| CVE-2026-35385 |
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download |
| CVE-2026-35386 |
In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the |
| CVE-2026-35387 |
OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is |
| CVE-2026-35388 |
OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions. |
| CVE-2026-35414 |
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certific |
|
|
openssh (1:8.9p1-3ubuntu0.14) jammy-security; urgency=medium
* SECURITY UPDATE: GSSAPI Key Exchange issue
- debian/patches/gssapi.patch: replace incorrect use of
sshpkt_disconnect() with ssh_packet_disconnect() and properly
initialize some vars.
- CVE-2026-3497
* SECURITY UPDATE: Untrusted control characters in usernames
- debian/patches/CVE-2025-61984.patch: refuse usernames that include
control characters in ssh.c.
- CVE-2025-61984
* SECURITY UPDATE: Code execution in ProxyCommand via NULL character
- debian/patches/CVE-2025-61985.patch: don't allow \0 characters in
url-encoded strings in misc.c.
- CVE-2025-61985
-- Marc Deslauriers <email address hidden> Wed, 04 Mar 2026 12:55:04 -0500
|
| Source diff to previous version |
| CVE-2026-3497 |
Vulnerability in the OpenSSH GSSAPI delta included in various Linux di ... |
| CVE-2025-61984 |
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code |
| CVE-2025-61985 |
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used. |
|
|
openssh (1:8.9p1-3ubuntu0.13) jammy-security; urgency=medium
* SECURITY UPDATE: incorrect DisableForwarding directive behaviour
- debian/patches/CVE-2025-32728.patch: fix logic error in session.c.
- CVE-2025-32728
-- Marc Deslauriers <email address hidden> Fri, 11 Apr 2025 08:05:47 -0400
|
| Source diff to previous version |
| CVE-2025-32728 |
In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwardin |
|
|
openssh (1:8.9p1-3ubuntu0.11) jammy-security; urgency=medium
* SECURITY UPDATE: MitM with VerifyHostKeyDNS option
- debian/patches/CVE-2025-26465.patch: fix error code handling in
krl.c, ssh-agent.c, ssh-sk-client.c, sshconnect2.c, sshsig.c.
- CVE-2025-26465
-- Marc Deslauriers <email address hidden> Tue, 11 Feb 2025 08:51:51 -0500
|
|
|
About
-
Send Feedback to @ubuntu_updates
