Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: openssh: openssh-10.3p1-2.hum1 aarch64, x8664 openssh-askpass-10.3p1-2.hum1 aarch64, x8664 openssh-clients-10.3p1-2.hum1 aarch64, x8664 openssh-keycat-10.3p1-2.hum1 aarch64, x8664...

Debian dsa-6204 : openssh-client - security update

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6204 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6204-1 [email protected]...

RHEL 9 : openssh (RHSA-2026:9415)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:9415 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary f...

CLSA-2026-1776428482 openssh: Fix of 3 CVEs

CVE-2026-35387: correctly match ECDSA signature algorithms against HostKeyAlgorithms, PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms - CVE-2026-35388: add missing askpass check when using ControlMaster=ask/autoask and "ssh -O proxy ..." - CVE-2026-35414: fix authorizedkeys principals...

[SECURITY] [DLA 4535-1] openssh security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4535-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort April 16, 2026 https://wiki.debian.org/LTS -...

Security Bulletin: Vulnerabilities in OpenSSH affects IBM Netezza Appliance

Summary The OpenSSH package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVEs CVE-2025-61984, CVE-2025-61985 Vulnerability Details CVEID:CVE-2025-61984 DESCRIPTION: ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certa...

CVE-2026-35388 affecting package openssh for versions less than 9.8p1-6

CVE-2026-35388 affecting package openssh for versions less than 9.8p1-6. A patched version of the package is available...

CVE-2026-35386 affecting package openssh for versions less than 9.8p1-6

CVE-2026-35386 affecting package openssh for versions less than 9.8p1-6. A patched version of the package is available...

CVE-2026-35385 affecting package openssh for versions less than 9.8p1-6

CVE-2026-35385 affecting package openssh for versions less than 9.8p1-6. A patched version of the package is available...

ROOT-OS-DEBIAN-11-CVE-2026-3497 CVE-2026-3497 in rootio-openssh - Patched by Root

Root has patched CVE-2026-3497 in the rootio-openssh package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-35414 CVE-2026-35414 in rootio-openssh - Patched by Root

Root has patched CVE-2026-35414 in the rootio-openssh package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-35385 CVE-2026-35385 in rootio-openssh - Patched by Root

Root has patched CVE-2026-35385 in the rootio-openssh package for Root:Debian:11. Multiple fixed versions available...

AlmaLinux 9 : openssh (ALSA-2026:6462)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:6462 advisory. openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables CVE-2026-3497 Tenable has extracted the preceding description...

AlmaLinux 10 : openssh (ALSA-2026:6463)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:6463 advisory. openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables CVE-2026-3497 Tenable has extracted the preceding description...

AlmaLinux 8 : openssh (ALSA-2026:6461)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:6461 advisory. openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables CVE-2026-3497 Tenable has extracted the preceding description...

Debian: Security Advisory (DSA-6204-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

JLSEC-2026-67

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9...

JLSEC-2026-65

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with...

JLSEC-2026-66

OpenSSH server sshd 9.1 introduced a double-free vulnerability during options.kexalgorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One...

JLSEC-2026-70

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or...