Описание
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
Меры по смягчению последствий
Disable GSSAPIKeyExchange.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 8 | libssh | Not affected | ||
| Red Hat Enterprise Linux 9 | libssh | Not affected | ||
| Red Hat Enterprise Linux 10 | libssh | Fixed | RHSA-2026:55855 | 17.08.2026 |
| Red Hat Hardened Images | libssh-main-0.12.1-4.hum1 | Fixed | RHSA-2026:42922 | 21.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, ...
EPSS
8.8 High
CVSS3