Red Hat Security Advisory

RHSA-2026:24349

libssh security update

Released 2026-06-08 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream AUS (v.8.4) libssh-devel-0.9.4-2.el8_4.2
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libssh-devel-0.9.4-2.el8_4.2
Red Hat Enterprise Linux BaseOS AUS (v.8.4) libssh-0.9.4-2.el8_4.2, libssh-config-0.9.4-2.el8_4.2
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libssh-0.9.4-2.el8_4.2, libssh-config-0.9.4-2.el8_4.2

Fixes 1 record

TI-2025-04824 CVE-2025-5372 · GHSA-59w5-j22f-h3rv

Libssh: incorrect return code handling in ssh_kdf() in libssh

LOW 39

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00513 Published 2025-07-04 Partial fix · 0.11.2, 0.9.6-16.el8_10 +4 CWE-682