CLSA-2026-1767955216 openssh: Fix of 2 CVEs

CVE-2025-61984: fix username handling by rejecting control characters from untrusted sources to prevent ProxyCommand code execution - CVE-2025-61985: disallowed NUL characters in ssh:// URI parsing to prevent ProxyCommand-based code execution...

AlmaLinux 10 : openssh (ALSA-2025:23479)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:23479 advisory. openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand CVE-2025-61984 openssh: OpenSSH: Null character in ssh://...

RLSA-2025:23481 Moderate: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand...

openssh security update

An update is available for openssh. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list OpenSSH is an SSH protocol implementation supported by a number of Linux, UNI...

openssh security update

8.0p1-27.0.1 - Update upstream references Orabug: 36587718 8.0p1-27 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-128400 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-128390...

RockyLinux 8 : openssh (RLSA-2025:23481)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:23481 advisory. openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand CVE-2025-61984 openssh: OpenSSH: Null character in ssh://...

RHEL 8 : openssh (RHSA-2025:23481)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23481 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files...

RHEL 10 : openssh (RHSA-2025:23479)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23479 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files...

SUSE SLES12 Security Update : openssh (SUSE-SU-2025:4097-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:4097-1 advisory. - CVE-2025-61984: Fixed code execution via control characters in usernames when a ProxyCommand is used bsc1251198 Tenable has extracted the preceding...

SUSE SLES12: openssh8.4 / openssh8.4-clients / openssh8.4-common / etc (SUSE-SU-2025:4098-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4098-1 advisory. - CVE-2025-61984: Fixed code execution via control characters in usernames when a ProxyCommand is used bsc1251198 - CVE-2025-61985: Fixed code...

OESA-2025-2646 openssh security update

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \ capabilities, several authentication methods, and...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: openssh (UTSA-2025-988576)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988576 advisory. ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when ...

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)

...

Linux Distros Unpatched Vulnerability : CVE-2025-61984

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution...

EUVD-2025-32589

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. A configuration...

AZL-68231 CVE-2025-61984 affecting package openssh for versions less than 9.8p1-5

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. A configuration...

PT-2025-40939

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.1 Alma Linux affected versions not specified SUSE affected versions not specified IBM AIX affected versions not specified Fortinet FortiWeb affected versions not specified Description OpenSSH before version 10.1...

CVE-2025-61984

CVE-2025-61984 affects OpenSSH before 10.1. It allows control characters in usernames originating from untrusted sources (command line or %-sequence expansion in a config file), potentially enabling code execution when a ProxyCommand is used. A config file that provides a complete literal usernam...

PT-2022-5667 · Atlassian · Bitbucket Server +1

Name of the Vulnerable Software and Affected Versions: Atlassian Bitbucket Server and Data Center affected versions not specified Description: The issue is related to a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to...