Описание
Security update for openssh
This update for openssh fixes the following issues:
- CVE-2026-73282: unsynchronized remote forwarding updates in SSH client multiplexing can cause use-after-free (bsc#1275074).
- CVE-2026-73283: unenforced restriction keywords on tunnel forwarding can allow administrative security policy bypasses (bsc#1275079).
Список пакетов
SUSE Linux Enterprise Server 12 SP5-LTSS
openssh-7.2p2-81.43.1
openssh-askpass-gnome-7.2p2-81.43.1
openssh-fips-7.2p2-81.43.1
openssh-helpers-7.2p2-81.43.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
openssh-7.2p2-81.43.1
openssh-askpass-gnome-7.2p2-81.43.1
openssh-fips-7.2p2-81.43.1
openssh-helpers-7.2p2-81.43.1
Ссылки
- Link for SUSE-SU-2026:4686-1
- E-Mail link for SUSE-SU-2026:4686-1
- SUSE Security Ratings
- SUSE Bug 1275074
- SUSE Bug 1275079
- SUSE CVE CVE-2026-73282 page
- SUSE CVE CVE-2026-73283 page
Описание
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
Затронутые продукты
SUSE Linux Enterprise Server 12 SP5-LTSS:openssh-7.2p2-81.43.1
SUSE Linux Enterprise Server 12 SP5-LTSS:openssh-askpass-gnome-7.2p2-81.43.1
SUSE Linux Enterprise Server 12 SP5-LTSS:openssh-fips-7.2p2-81.43.1
SUSE Linux Enterprise Server 12 SP5-LTSS:openssh-helpers-7.2p2-81.43.1
Ссылки
- CVE-2026-73282
- SUSE Bug 1275074
Описание
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
Затронутые продукты
SUSE Linux Enterprise Server 12 SP5-LTSS:openssh-7.2p2-81.43.1
SUSE Linux Enterprise Server 12 SP5-LTSS:openssh-askpass-gnome-7.2p2-81.43.1
SUSE Linux Enterprise Server 12 SP5-LTSS:openssh-fips-7.2p2-81.43.1
SUSE Linux Enterprise Server 12 SP5-LTSS:openssh-helpers-7.2p2-81.43.1
Ссылки
- CVE-2026-73283
- SUSE Bug 1275079
- SUSE Bug 1284708
- SUSE Bug 1285629