Описание
Security update for openssh8.4
This update for openssh8.4 fixes the following issues:
- CVE-2026-59995: sftp: a malicious server could change the the location of downloaded files (bsc#1271044).
- CVE-2026-59997: sshd: internal-sftp command lines are silently truncated after the 9th argument (bsc#1271048).
- CVE-2026-59998: sshd: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory (bsc#1271049).
- CVE-2026-59999: sshd: DisableForwarding=yes didn't override PermitTunnel=yes (bsc#1271052).
- CVE-2026-60000: sshd: pre-authentication denial of service when GSSAPIAuthentication is enabled (bsc#1271053).
- CVE-2026-60001: sshd: honor the minimum authentication delay (bsc#1271054).
- CVE-2026-60002: ssh: client-side use-after-free when a server changes its host key during a key reexchange (bsc#1271055).
Список пакетов
SUSE Linux Enterprise Server 12 SP5-LTSS
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
Ссылки
- Link for SUSE-SU-2026:4907-1
- E-Mail link for SUSE-SU-2026:4907-1
- SUSE Security Ratings
- SUSE Bug 1271044
- SUSE Bug 1271048
- SUSE Bug 1271049
- SUSE Bug 1271052
- SUSE Bug 1271053
- SUSE Bug 1271054
- SUSE Bug 1271055
- SUSE CVE CVE-2026-59995 page
- SUSE CVE CVE-2026-59997 page
- SUSE CVE CVE-2026-59998 page
- SUSE CVE CVE-2026-59999 page
- SUSE CVE CVE-2026-60000 page
- SUSE CVE CVE-2026-60001 page
- SUSE CVE CVE-2026-60002 page
Описание
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
Затронутые продукты
Ссылки
- CVE-2026-59995
- SUSE Bug 1271044
- SUSE Bug 1285147
- SUSE Bug 1285532
Описание
internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.
Затронутые продукты
Ссылки
- CVE-2026-59997
- SUSE Bug 1271048
- SUSE Bug 1285147
- SUSE Bug 1285532
Описание
sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.
Затронутые продукты
Ссылки
- CVE-2026-59998
- SUSE Bug 1271049
- SUSE Bug 1285147
- SUSE Bug 1285532
Описание
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.
Затронутые продукты
Ссылки
- CVE-2026-59999
- SUSE Bug 1271052
- SUSE Bug 1285147
- SUSE Bug 1285532
- SUSE Bug 1285629
Описание
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.
Затронутые продукты
Ссылки
- CVE-2026-60000
- SUSE Bug 1271053
Описание
sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.
Затронутые продукты
Ссылки
- CVE-2026-60001
- SUSE Bug 1271054
Описание
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)
Затронутые продукты
Ссылки
- CVE-2026-60002
- SUSE Bug 1271055
- SUSE Bug 1271636
- SUSE Bug 1271706
- SUSE Bug 1285147
- SUSE Bug 1285532