Описание
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| libssh | fixed | 0.12.1-1 | package | |
| libssh | not-affected | trixie | package | |
| libssh | not-affected | bookworm | package | |
| libssh | not-affected | bullseye | package |
Примечания
https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/
https://www.libssh.org/security/advisories/CVE-2026-59851.txt
Introduced with: https://git.libssh.org/projects/libssh.git/commit/?id=9044fcdb52c870f0036319945ac860054384b2c1 (libssh-0.12.0)
Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=73225a1774b32774ccc77f6fbd0a48e11505a6db (libssh-0.12.1)
Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=05d0fe43b599a867906e8fe96ad78e0cda204128 (libssh-0.12.1)
Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=f2f1078d6d7383eaa24570094d3a27c90e6e5f21 (libssh-0.12.1)
EPSS
Связанные уязвимости
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
EPSS