Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:4614-1

Опубликовано: 12 окт. 2026
Источник: suse-cvrf

Описание

Security update for openssh8.4

This update for openssh8.4 fixes the following issues:

  • CVE-2026-73282: unsynchronized remote forwarding updates in SSH client multiplexing can cause use-after-free (bsc#1275074).
  • CVE-2026-73283: unenforced restriction keywords on tunnel forwarding can allow administrative security policy bypasses (bsc#1275079).

Список пакетов

SUSE Linux Enterprise Server 12 SP5-LTSS
openssh8.4-8.4p1-8.27.1
openssh8.4-clients-8.4p1-8.27.1
openssh8.4-common-8.4p1-8.27.1
openssh8.4-fips-8.4p1-8.27.1
openssh8.4-helpers-8.4p1-8.27.1
openssh8.4-server-8.4p1-8.27.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
openssh8.4-8.4p1-8.27.1
openssh8.4-clients-8.4p1-8.27.1
openssh8.4-common-8.4p1-8.27.1
openssh8.4-fips-8.4p1-8.27.1
openssh8.4-helpers-8.4p1-8.27.1
openssh8.4-server-8.4p1-8.27.1

Ссылки

Описание

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP5-LTSS:openssh8.4-8.4p1-8.27.1
SUSE Linux Enterprise Server 12 SP5-LTSS:openssh8.4-clients-8.4p1-8.27.1
SUSE Linux Enterprise Server 12 SP5-LTSS:openssh8.4-common-8.4p1-8.27.1
SUSE Linux Enterprise Server 12 SP5-LTSS:openssh8.4-fips-8.4p1-8.27.1
Ссылки

Описание

In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP5-LTSS:openssh8.4-8.4p1-8.27.1
SUSE Linux Enterprise Server 12 SP5-LTSS:openssh8.4-clients-8.4p1-8.27.1
SUSE Linux Enterprise Server 12 SP5-LTSS:openssh8.4-common-8.4p1-8.27.1
SUSE Linux Enterprise Server 12 SP5-LTSS:openssh8.4-fips-8.4p1-8.27.1
Ссылки