Описание
Security update for apache-sshd
This update for apache-sshd fixes the following issues:
Update to upstream version 2.19.0.
Security issues fixed:
- CVE-2026-56452: remote users can use SCP to send filenames that lead to arbitrary file writes due to a path traversal
issue in the
sshd-scpcomponent of Apache MINA SSHD. (bsc#1272158). - CVE-2026-56623: remote users can obtain access to git repositories outside of the configured server-side root
directory on Windows systems due to path traversal issue in
org.apache.sshd:sshd-git(bsc#1271993). - CVE-2026-56624: users can authenticate with certificates containing the
force-commandoption but still execute other commands due to improper validation of certificate options in Apache MINA SSHD (bsc#1271992). - CVE-2026-58624: remote execution of JGit commands can lead to arbitrary file writes due to improper input validation
in
sshd-gitof Apache MINA SSHD (bsc#1271991).
Other updates and bugfixes:
- Version 2.19.0:
- Bug Fixes
- GH-899 Fix ProcessShellFactory on Linux.
- GH-902 Fix client-side handling of sk-* public key signatures (also in the agent interfaces).
- Limit size of decompressed SSH packets.
- Improve checking SSH user certificates in public-key authentication.
- Improve handling of repository paths in sshd-git on Windows.
- Validate file names in SCP.
- Escape newlines in filenames in the SCP protocol.
- Restrict JGit commands accessible via GitPgmCommandFactory in sshd-git.
- Bug Fixes
Список пакетов
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Module for Development Tools 15 SP7
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP5
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:3339-1
- E-Mail link for SUSE-SU-2026:3339-1
- SUSE Security Ratings
- SUSE Bug 1271991
- SUSE Bug 1271992
- SUSE Bug 1271993
- SUSE Bug 1272158
- SUSE CVE CVE-2026-56452 page
- SUSE CVE CVE-2026-56623 page
- SUSE CVE CVE-2026-56624 page
- SUSE CVE CVE-2026-58624 page
Описание
Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. The issue affects only * applications that use no longer supported Apache MINA SSHD versions < 2.0.0 and use the SCP functions to receive files, * or applications using sshd-scp in Apache MINA SSHD >= 2.0.0 to receive files. Applications using Apache MINA SSHD >= 2.0.0 not using sshd-scp are not affected. The issue is fixed in Apache MINA 2.19.0 and 3.0.0-M5. Affected applications are advised to upgrade to these versions.
Затронутые продукты
Ссылки
- CVE-2026-56452
- SUSE Bug 1272158
Описание
Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories outside of the configured server-side root directory. The path validation applied for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 was partly ineffective for Servers running on Windows. Applications are affected if they use org.apache.sshd:sshd-git to implement a git server and run on Windows. Applications not using sshd-git or not running on Windows are not affected. Users are advised to upgrade affected applications to Apache MINA SSHD 2.19.0, which fixes the issue. The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M4 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git and run on Windows. Upgrade affected applications to 3.0.0-M5.
Затронутые продукты
Ссылки
- CVE-2026-56623
- SUSE Bug 1271993
Описание
Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server. This issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions. The fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*-cert-v01@openssh.com user certificates (which are the only ones for which verify-required would make sense).
Затронутые продукты
Ссылки
- CVE-2026-56624
- SUSE Bug 1271992
Описание
Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server. This GitPgmCommandFactory allowed a user authenticated via SSH to run any JGit command available, including commands that could write files at arbitrary places such as git archive with the --output option. Affected are SSH servers implemented with Apache MINA SSHD and using the GitPgmCommandFactory. If the GitPgmCommandFactory is not configured on the server, the server is not affected. It is recommended to upgrade affected servers to Apache MINA SSHD 2.19.0 or 3.0.0-M5, which fix this issue. The issue is fixed by restricting the available commands to a small whitelist of uncritical commands (such as git log). git archive is also allowed, but its --output argument is ignored and the archive is always sent through the SSH channel to the client.
Затронутые продукты
Ссылки
- CVE-2026-58624
- SUSE Bug 1271991