Описание
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
A flaw was found in sshd, the OpenSSH server daemon. When DisableForwarding=yes is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over PermitTunnel=yes. This allows a remote attacker to bypass intended security restrictions and establish a tunnel, potentially leading to unauthorized network access or circumvention of security policies, even when forwarding is explicitly disabled.
Отчет
This Moderate severity flaw in OpenSSH sshd allows PermitTunnel=yes to override DisableForwarding=yes, potentially bypassing intended security controls. In Red Hat environments where DisableForwarding is used to restrict SSH session capabilities, an attacker who compromises a user's session could still establish a tunnel, leading to unauthorized network access or data exfiltration. This bypass occurs even when administrators explicitly attempt to prevent forwarding, though PermitTunnel is not enabled by default.
Меры по смягчению последствий
To mitigate this issue, if DisableForwarding=yes is set in /etc/ssh/sshd_config to prevent all forwarding, ensure that PermitTunnel is explicitly set to no in the same configuration file. This will enforce the intended security policy.
After modifying /etc/ssh/sshd_config, restart the sshd service for the changes to take effect. This may temporarily interrupt active SSH sessions.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | openssh | Affected | ||
| Red Hat Enterprise Linux 7 | openssh | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Affected | ||
| Red Hat Enterprise Linux 10 | openssh | Fixed | RHSA-2026:69129 | 21.09.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | openssh | Fixed | RHSA-2026:76748 | 06.10.2026 |
| Red Hat Enterprise Linux 8 | openssh | Fixed | RHSA-2026:69266 | 21.09.2026 |
| Red Hat Enterprise Linux 8 | openssh | Fixed | RHSA-2026:69266 | 21.09.2026 |
| Red Hat Enterprise Linux 9 | openssh | Fixed | RHSA-2026:69130 | 21.09.2026 |
| Red Hat Enterprise Linux 9 | openssh | Fixed | RHSA-2026:69130 | 21.09.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to ...
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
EPSS
7.5 High
CVSS3