Red Hat Security AdvisoryRHSA-2025:23480
openssh security update
Released 2025-12-17 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) openssh-askpass-8.7p1-47.el9_7, pam_ssh_agent_auth-0.10.4-5.47.el9_7
- Red Hat Enterprise Linux BaseOS (v. 9) openssh-8.7p1-47.el9_7, openssh-clients-8.7p1-47.el9_7, openssh-keycat-8.7p1-47.el9_7 +1
Fixes 2 records
Priority MEDIUM 52
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used.
CVSS 3.1LOW 3.6· Local · Low privileges · No interaction · EPSS 0.00463 · Published 2025-10-06 · Partial fix · 10.1 CWE-159
Priority LOW 16
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.
CVSS 3.1LOW 3.6· Local · Low privileges · No interaction · EPSS 0.00125 · Published 2025-10-06 · Partial fix · 10.1 CWE-158
