Описание
Security update for amazon-ssm-agent
This update for amazon-ssm-agent fixes the following issue:
- CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1278681)
- CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1278681)
- CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1278681).
Changes for amazon-ssm-agent:
- Update to version 3.3.5390.0
Список пакетов
SUSE Linux Enterprise Module for Public Cloud 15 SP4
SUSE Linux Enterprise Module for Public Cloud 15 SP5
SUSE Linux Enterprise Module for Public Cloud 15 SP6
SUSE Linux Enterprise Module for Public Cloud 15 SP7
Ссылки
- Link for SUSE-SU-2026:4372-1
- E-Mail link for SUSE-SU-2026:4372-1
- SUSE Security Ratings
- SUSE Bug 1278681
- SUSE CVE CVE-2026-56854 page
- SUSE CVE CVE-2026-56855 page
- SUSE CVE CVE-2026-78662 page
Описание
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.
Затронутые продукты
Ссылки
- CVE-2026-56854
- SUSE Bug 1278446
- SUSE Bug 1280553
Описание
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.
Затронутые продукты
Ссылки
- CVE-2026-56855
- SUSE Bug 1278446
- SUSE Bug 1280553
Описание
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.
Затронутые продукты
Ссылки
- CVE-2026-78662
- SUSE Bug 1278446
- SUSE Bug 1280553