CLSA-2026-1792154919 Fix CVE(s): CVE-2026-106553, CVE-2026-106555, CVE-2026-106583

SECURITY UPDATE: GSSAPI client state persisting across authentication attempts - debian/patches/CVE-2026-106555.patch: reset the GSSAPI client state at the start of each userauth request and of each pre-authentication GSSAPI context setup in the monitor. - CVE-2026-106555 SECURITY UPDATE: GSSAPI...

CVE-2026-110924

Rejected reason: CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553...

UBUNTU-CVE-2026-110924

Rejected reason: CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553...

CVE-2026-110924

Rejected reason: CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553...

CVE-2026-110924

...

CVE-2026-110924

A vulnerability exists in OpenSSH when GSSAPI authentication is enabled. A failed GSSAPI authentication attempt can cause delegated credentials to remain stored for the connection, even if the user authorization fails. Consequently, a subsequent successful login on that same connection may be imp...

EUVD-2026-102054

A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state...

CVE-2026-110924

...

CVE-2026-110924

A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state...

CVE-2026-110924

A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state...

PT-2026-114929

Name of the Vulnerable Software and Affected Versions OpenSSH affected versions not specified Description When GSSAPI authentication is enabled, a failed GSSAPI attempt may leave delegated credentials stored for the connection despite the failure of user authorization. Consequently, a subsequent...

CVE-2026-110924: Incomplete Cleanup

Rejected reason: CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553...

CVE-2026-42810

Apache Polaris accepts literal characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those same characters appear to be reused unescaped in S3 IAM resource patterns and s3:prefix conditions. In S3 IAM policy matching, is treated as ...

CVE-2026-42810

CVE-2026-42810 affects Apache Polaris. The issue arises because Polaris accepts literal ‘’ characters in namespace and table names, and these unescaped characters are reused in temporary S3 access policies for delegated table access. In S3 IAM policy matching, ‘ ’ is treated as a wildcard, allowi...

MiracleLinux 4 : elinks-0.12-0.21.pre5.AXS4 (AXSA:2013-110:01)

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2013-110:01 advisory. Links is a text-based Web browser. Links does not display any images, but it does support frames, tables and most other HTML tags. Links' advantage over...

MiracleLinux 3 : elinks-0.11.1-8.AXS3 (AXSA:2013-101:01)

The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2013-101:01 advisory. Links is a text-based Web browser. Links does not display any images, but it does support frames, tables and most other HTML tags. Links' advantage over...

SUSE CVE-2005-2798

sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, allows GSSAPI credentials to be delegated to clients who log in using non-GSSAPI methods, which could cause those credentials to be exposed to untrusted users or hosts...

Explained: How New 'Delegated Credentials' Boosts TLS Protocol Security

Mozilla, in partnership with Facebook, Cloudflare, and other IETF community members, has announced technical specifications for a new cryptographic protocol called "Delegated Credentials for TLS." Delegated Credentials for TLS is a new simplified way to implement "short-lived" certificates withou...

Explained: How New 'Delegated Credentials' Boosts TLS Protocol Security

Mozilla, in partnership with Facebook, Cloudflare, and other IETF community members, has announced technical specifications for a new cryptographic protocol called "Delegated Credentials for TLS." Delegated Credentials for TLS is a new simplified way to implement "short-lived" certificates withou...

Oracle Linux 5 : Critical: / krb5 (ELSA-2008-0164)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0164 advisory. 1.6.1-17.el51.1 - add preliminary patch to fix use of uninitialized pointer / double-free in KDC CVE-2008-0062,CVE-2008-0063 432620, 432621 - add...