Red Hat Security AdvisoryRHSA-2026:1678
openssh security update
Released 2026-02-02 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) openssh-askpass-9.9p1-7.el10_0.1, openssh-keysign-9.9p1-7.el10_0.1
- Red Hat Enterprise Linux BaseOS EUS (v. 10.0) openssh-9.9p1-7.el10_0.1, openssh-clients-9.9p1-7.el10_0.1, openssh-keycat-9.9p1-7.el10_0.1 +1
Fixes 2 records
Priority MEDIUM 52
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used.
CVSS 3.1LOW 3.6· Local · Low privileges · No interaction · EPSS 0.00463 · Published 2025-10-06 · Partial fix · 10.1 CWE-159
Priority LOW 16
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.
CVSS 3.1LOW 3.6· Local · Low privileges · No interaction · EPSS 0.00125 · Published 2025-10-06 · Partial fix · 10.1 CWE-158
