Описание
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
A flaw was found in sshd, the OpenSSH server daemon. When DisableForwarding=yes is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over PermitTunnel=yes. This allows a remote attacker to bypass intended security restrictions and establish a tunnel, potentially leading to unauthorized network access or circumvention of security policies, even when forwarding is explicitly disabled.
Меры по смягчению последствий
To mitigate this issue, if DisableForwarding=yes is set in /etc/ssh/sshd_config to prevent all forwarding, ensure that PermitTunnel is explicitly set to no in the same configuration file. This will enforce the intended security policy.
After modifying /etc/ssh/sshd_config, restart the sshd service for the changes to take effect. This may temporarily interrupt active SSH sessions.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | openssh | Fix deferred | ||
| Red Hat Enterprise Linux 6 | openssh | Affected | ||
| Red Hat Enterprise Linux 7 | openssh | Fix deferred | ||
| Red Hat Enterprise Linux 8 | openssh | Fix deferred | ||
| Red Hat Enterprise Linux 9 | openssh | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Fix deferred | ||
| Red Hat Hardened Images | openssh-main-10.4p1-1.hum1 | Fixed | RHSA-2026:37382 | 09.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to ...
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
EPSS
5.9 Medium
CVSS3