Red Hat Security AdvisoryRHSA-2026:1815
openssh security update
Released 2026-02-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v.9.2) openssh-askpass-8.7p1-30.el9_2.9, pam_ssh_agent_auth-0.10.4-5.30.el9_2.9
- Red Hat Enterprise Linux BaseOS E4S (v.9.2) openssh-8.7p1-30.el9_2.9, openssh-clients-8.7p1-30.el9_2.9, openssh-keycat-8.7p1-30.el9_2.9 +1
Fixes 2 records
Priority MEDIUM 52
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used.
CVSS 3.1LOW 3.6· Local · Low privileges · No interaction · EPSS 0.00463 · Published 2025-10-06 · Partial fix · 10.1 CWE-159
Priority LOW 16
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.
CVSS 3.1LOW 3.6· Local · Low privileges · No interaction · EPSS 0.00125 · Published 2025-10-06 · Partial fix · 10.1 CWE-158
