Red Hat Security AdvisoryRHSA-2025:23481
openssh security update
Released 2025-12-17 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) openssh-askpass-8.0p1-27.el8_10
- Red Hat Enterprise Linux BaseOS (v. 8) openssh-8.0p1-27.el8_10, openssh-cavs-8.0p1-27.el8_10, openssh-clients-8.0p1-27.el8_10 +4
Fixes 2 records
Priority MEDIUM 52
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used.
CVSS 3.1LOW 3.6· Local · Low privileges · No interaction · EPSS 0.00463 · Published 2025-10-06 · Partial fix · 10.1 CWE-159
Priority LOW 16
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.
CVSS 3.1LOW 3.6· Local · Low privileges · No interaction · EPSS 0.00125 · Published 2025-10-06 · Partial fix · 10.1 CWE-158
