Release date:
2026-10-20 16:31:49 UTC
Description:
- CVE-2026-106587: sshd did not clear AuthorizedPrincipalsFile,
TrustedUserCAKeys and Banner when a Match block set them to "none", so
the global value stayed in effect before authentication; clear them in
the pre-auth part of copy_set_server_options(). Backport upstream
commit 526fd277.
- CVE-2026-106586: sshd dropped the authorized_keys "restrict" flag when
merging key and certificate options, which could re-enable features such
as tunnel forwarding; OR the restricted flag in sshauthopt_merge().
Backport upstream commit 991f1f31.
- CVE-2026-106552: sftp(1) accepted an empty file name from a server
directory listing and could pick ".." or the local root as an implicit
download destination; reject empty names and map ".." and remote roots
to ".". Backport upstream commit c07ea218.
- CVE-2026-106584: ssh-keygen(1) converted certificate validity dates
without letting mktime() decide DST, giving expiry times off by an hour;
set tm_isdst to -1 in parse_absolute_time(). Backport upstream commit
aef20dfe.
- CVE-2026-106582: compressed SSH sessions used the zlib LZ77 dictionary
coder, exposing a compression side channel; use Huffman-only
compression for outgoing packets. Backport upstream commit 1d5340fc.
Updated packages:
-
openssh-8.7p1-30.el9_2.tuxcare.els25.aarch64.rpm
sha:589d00e2451578f0b91121d9abb0c26e386d0a0cff265de6b7d76cc3d8a68445
-
openssh-8.7p1-30.el9_2.tuxcare.els25.i686.rpm
sha:fcd17b417fa06e2b4a25f1177c97cd95270baaa5f095476c3faacc934c828562
-
openssh-8.7p1-30.el9_2.tuxcare.els25.x86_64.rpm
sha:3c25392fab78faa657aa790bcc15e230fc0243c2500c30f265b29bc0943e15ee
-
openssh-askpass-8.7p1-30.el9_2.tuxcare.els25.aarch64.rpm
sha:c7e48531c3e46ce0e1919f75eeb80af5c863fb5ad234778f53c6a8d9c78983a1
-
openssh-askpass-8.7p1-30.el9_2.tuxcare.els25.i686.rpm
sha:2b8d178ff12160fbc5619e5b4be0480e4f970ced075c6deccd9ec81db686aafe
-
openssh-askpass-8.7p1-30.el9_2.tuxcare.els25.x86_64.rpm
sha:a5174c6bde64122c4f24e227986518b94e0de6a93c89d4855f8205e41b280a91
-
openssh-clients-8.7p1-30.el9_2.tuxcare.els25.aarch64.rpm
sha:096b81c21b6dd1c434381b56250089e533f4c92da7f00898e6170a32f10f7ffc
-
openssh-clients-8.7p1-30.el9_2.tuxcare.els25.i686.rpm
sha:6169cb5f5f501af87eaaa0e810c17999852ab29eb7ac9f0bc7b3cb72e858b2db
-
openssh-clients-8.7p1-30.el9_2.tuxcare.els25.x86_64.rpm
sha:4e2e22ed39c8f645c30eb21b9b92fd665ff2dcdb12c57831358c11d828d87fce
-
openssh-keycat-8.7p1-30.el9_2.tuxcare.els25.aarch64.rpm
sha:28fe610d9090756be5e0ba77f693afedbbd42891263b13748da888b7ad9cce35
-
openssh-keycat-8.7p1-30.el9_2.tuxcare.els25.i686.rpm
sha:2cd01aaa858db268b67e4fb04579403e9be3a260ca1c8da382b1da7537b3fe18
-
openssh-keycat-8.7p1-30.el9_2.tuxcare.els25.x86_64.rpm
sha:ed1cbefbc29e5a2dded6a8254fd2b8d9bd784d553308529034ca02e44d90f8b7
-
openssh-server-8.7p1-30.el9_2.tuxcare.els25.aarch64.rpm
sha:11d00e0c460d48de04c4ee18f3b2c2d905bf0c7feddce27db90fe274a207edab
-
openssh-server-8.7p1-30.el9_2.tuxcare.els25.i686.rpm
sha:1f118871a3cb799efee9d3b22c65b20712a6a7adfd0c5dd2fff06d95fd01b842
-
openssh-server-8.7p1-30.el9_2.tuxcare.els25.x86_64.rpm
sha:e1a20ae8c04cb93da2b8ba80646ed881db6c064c2fe5dae743d276b882461e56
-
openssh-sk-dummy-8.7p1-30.el9_2.tuxcare.els25.aarch64.rpm
sha:4fb6a4a9030f3edb6f1d5466dcc0062a4c005481d9ef1d524d1a8f6188dc095b
-
openssh-sk-dummy-8.7p1-30.el9_2.tuxcare.els25.i686.rpm
sha:0b5061b59054e12eb92642edf0fe4a186298169184b183bae9306441c3f95a42
-
openssh-sk-dummy-8.7p1-30.el9_2.tuxcare.els25.x86_64.rpm
sha:4a2c138b3191024623e7b687318e3177447ee5a5e006682368f9b9df1ef8e174
-
pam_ssh_agent_auth-0.10.4-5.30.el9_2.tuxcare.els25.aarch64.rpm
sha:b01f68482b4bbaf21d6168d066ecb4446614af5a6346524e8e7743dd17941b84
-
pam_ssh_agent_auth-0.10.4-5.30.el9_2.tuxcare.els25.i686.rpm
sha:83976bc6213f41e45e4da4e25fe76f95252110e4550375d817c94b8915ea17a8
-
pam_ssh_agent_auth-0.10.4-5.30.el9_2.tuxcare.els25.x86_64.rpm
sha:4b57ff1b3d86c44ea1e38e1e4a5fb827af5299206d78b6fede4d9dde2c31e5f3
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
