Red Hat Security AdvisoryRHSA-2025:23479
openssh security update
Released 2025-12-17 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 10) openssh-askpass-9.9p1-12.el10_1, openssh-keysign-9.9p1-12.el10_1
- Red Hat Enterprise Linux BaseOS (v. 10) openssh-9.9p1-12.el10_1, openssh-clients-9.9p1-12.el10_1, openssh-keycat-9.9p1-12.el10_1 +1
Fixes 2 records
Priority MEDIUM 52
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used.
CVSS 3.1LOW 3.6· Local · Low privileges · No interaction · EPSS 0.00463 · Published 2025-10-06 · Partial fix · 10.1 CWE-159
Priority LOW 16
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.
CVSS 3.1LOW 3.6· Local · Low privileges · No interaction · EPSS 0.00125 · Published 2025-10-06 · Partial fix · 10.1 CWE-158
