openssh security update

8.7p1-48.0.1 - Upstream references found with /usr/bin/ssh Orabug: 37814929 - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand Orabug: 37647064 - Update upstream references Orabug: 36564626 8.7p1-48 - CVE-2026-3497: Fix information disclosure or denial of service due to...

Important: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

openssh security update

8.0p1-28.0.1 - Update upstream references Orabug: 36587718 8.0p1-28 - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155814...

openssh security update

9.9p1-13.0.1 - Upstream references found with /usr/bin/ssh Orabug: 37824421 9.9p1-13 - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155811...

ALSA-2026:6461 Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized...

CentOS 9 : openssh-9.9p1-7.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssh-9.9p1-7.el9 build changelog. - Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex CVE-2026-3497 Note that Nessus has not tested for...

AZL-81095 CVE-2026-0966 affecting package libssh for versions less than 0.10.6-7

A flaw was found in libssh. The API function sshgethexa is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI Generic Security Service Application Program Interface authentication if the server's logging verbosity is se...

CVE-2026-0966

A flaw was found in libssh. The API function sshgethexa is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI Generic Security Service Application Program Interface authentication if the server's logging verbosity is se...

CVE-2026-0966 Libssh: libssh: denial of service via zero-length input in ssh_get_hexa()

A flaw was found in libssh. The API function sshgethexa is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI Generic Security Service Application Program Interface authentication if the server's logging verbosity is se...

CVE-2026-0966

A flaw was found in libssh. The API function sshgethexa is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI Generic Security Service Application Program Interface authentication if the server's logging verbosity is se...

CVE-2026-0966

CVE-2026-0966 affects the libssh library with a buffer underflow in ssh_get_hexa() on invalid input. The issue occurs because ssh_get_hexa() is used by ssh_get_fingerprint_hash() and the deprecated ssh_print_hexa(), and also in gssapi logging. Remote triggering is possible when GSSAPI authenticat...

CVE-2026-0966 Libssh: libssh: denial of service via zero-length input in ssh_get_hexa()

A flaw was found in libssh. The API function sshgethexa is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI Generic Security Service Application Program Interface authentication if the server's logging verbosity is se...

CVE-2026-0966: Buffer Underwrite

A flaw was found in libssh. The API function sshgethexa is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI Generic Security Service Application Program Interface authentication if the server's logging verbosity is se...

Security Bulletin: Memory Safety Vulnerabilities in SSH Agents and Servers: Out-of-Bounds Read and Unbounded Memory Consumption, affects watsonx.data

Summary SSH Agent servers are vulnerable to out-of-bounds reads when processing malformed new identity requests, which can cause the agent to panic. Additionally, SSH servers handling GSSAPI authentication requests do not validate the number of mechanisms specified, potentially allowing attackers...

Fedora: Security Advisory (FEDORA-2026-39819a3d62)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS 9 : openssh-9.9p1-5.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssh-9.9p1-5.el9 build changelog. - Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex CVE-2026-3497 Note that Nessus has not tested for...

Fedora 44 : openssh (2026-62fb46caac)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-62fb46caac advisory. - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi- keyex Tenable has extracted the preceding...

Fedora 42 : openssh (2026-39819a3d62)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-39819a3d62 advisory. - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi- keyex Tenable has extracted the preceding...

Fedora 43 : openssh (2026-bab4aa5da7)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bab4aa5da7 advisory. - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi- keyex Tenable has extracted the preceding...

Ubuntu: Security Advisory (USN-8090-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...