Security Bulletin: IBM i is vulnerable to a machine-in-the-middle attack due to mishandling error codes when verifying the host key by OpenSSH. [CVE-2025-26465]

Summary OpenSSH used by IBM i is vulnerable to a machine-in-the-middle attack due to mishandling error codes when verifying the host key as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerability as described in the remediation/fixes...

Alibaba Cloud Linux 3 : 0090: openssh (ALINUX3-SA-2023:0090)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2023:0090 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2023-38408: The PKCS11 feature in ssh-agent in...

Alibaba Cloud Linux 3 : 0188: openssh (ALINUX3-SA-2022:0188)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0188 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2018-20685: In OpenSSH 7.9, scp.c in t...

Alibaba Cloud Linux 3 : 0013: openssh (ALINUX3-SA-2024:0013)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0013 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2023-51385: In ssh in OpenSSH before 9.6, OS...

Alibaba Cloud Linux 3 : 0199: openssh bug fix update (Moderate) (ALINUX3-SA-2024:0199)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0199 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2020-15778: scp in OpenSSH through 8.3...

RHSA-2025:6993 Red Hat Security Advisory: openssh security update

Bulletin has no description...

openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabled

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. Fo...

Moderate: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

RHEL 9 : openssh (RHSA-2025:6993)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:6993 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary f...

Huawei EulerOS: Security Advisory for openssh (EulerOS-SA-2025-1531)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ALSA-2025:6993 Moderate: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabled CVE-2025-26465 For more...

Huawei EulerOS: Security Advisory for openssh (EulerOS-SA-2025-1530)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Moderate: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabled CVE-2025-26465 For more...

EulerOS 2.0 SP10 : openssh (EulerOS-SA-2025-1530)

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious...

macOS 15.x < 15.5 Multiple Vulnerabilities (122716)

The remote host is running a version of macOS / Mac OS X that is 15.x prior to 15.5. It is, therefore, affected by multiple vulnerabilities: - A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine...

macOS 14.x < 14.7.6 Multiple Vulnerabilities (122717)

The remote host is running a version of macOS / Mac OS X that is 14.x prior to 14.7.6. It is, therefore, affected by multiple vulnerabilities: - A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine...

EulerOS 2.0 SP10 : openssh (EulerOS-SA-2025-1531)

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious...

Debian: Security Advisory (DLA-4156-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 4156-1] openssh security update

Debian LTS Advisory DLA-4156-1 [email protected] https://www.debian.org/lts/security/ Colin Watson May 08, 2025 https://wiki.debian.org/LTS Package : openssh Version : 1:8.4p1-5+deb11u5 CVE ID : CVE-2025-32728 Debian Bug : 1102603...

Debian dla-4156 : openssh-client - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4156 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4156-1 [email protected] https://www.debian.org/lts/security/...