{"schemaVersion":3,"id":"MGASA-2026-0521","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Updated openssh packages fix security vulnerabilities\n\nLocal mitm of x11 forwarding via abstract unix socket pre-binding in Red\nHat Enterprise Linux openssh client versions. (CVE-2026-55655)\nsftp in OpenSSH before 10.4 does not properly constrain the location of\ndownloaded files when \"sftp server:/path .\" is used with an\nattacker-controlled server. (CVE-2026-59995)\nscp in OpenSSH before 10.4 may place a file in the parent directory of\nan intended directory when the copy occurs between two remote\ndestinations. (CVE-2026-59996)\ninternal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9\ncommand-line arguments, which can be important if a later command-line\nargument would have helped to ensure the intended security properties of\nan SFTP connection. (CVE-2026-59997)\nsshd in OpenSSH before 10.4 has an undocumented security-relevant\nbehavior: GSSAPIStrictAcceptorCheck has no value if the server is in\nWindows Active Directory. (CVE-2026-59998)\nIn sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to\ntake precedence over PermitTunnel=yes, but did not. (CVE-2026-59999)\nsshd in OpenSSH before 10.4 allows remote attackers to cause a denial of\nservice (resource consumption from excessive authentication attempts)\nbecause MaxAuthTries was mishandled for GSSAPIAuthentication.\n(CVE-2026-60000)\nsshd in OpenSSH before 10.4 does not always honor the minimum\nauthentication delay. (CVE-2026-60001)\nssh in OpenSSH before 10.4 can have a use-after-free when a server\nchanges its host key during a key re-exchange. (This outcome occurs only\non the client side.). (CVE-2026-60002)\nIn ssh-agent in OpenSSH before 10.5, some operations can occur remotely\nbut were intended to occur only locally, including operations that add\ntokens or use keys. This is caused by misinteraction between agent\nlocking and the session-bind@openssh.com extension. (CVE-2026-73281)\nIn ssh in OpenSSH before 10.5, a use-after-free for realloc data can\noccur if a certain pair of remote-forwarding operations are concurrent.\n(CVE-2026-73282)\nIn sshd in OpenSSH before 10.5, the restrict keyword (in\nauthorized_keys) was supposed to be applicable to tunnel forwarding but\nwas not. (CVE-2026-73283)\nIn sftp in OpenSSH before 10.6, a server can trigger directory traversal\n(causing files to be written to unintended locations) during a recursive\ncopy operation. (CVE-2026-106552)\nIn sshd in OpenSSH before 10.6, credentials can incorrectly persist\nafter failure of a GSSAPIAuthentication authentication attempt.\n(CVE-2026-106553)\nIn sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication\nstate can incorrectly be persisted across authentication attempts.\n(CVE-2026-106555)\nIn sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be\nused even though this is contraindicated by the arXiv 2609.07709\n\"Crossing the Streams\" findings. (CVE-2026-106582)\nIn ssh in OpenSSH before 10.6, a $ or \\ character can occur in a\ncommand-line username, leading to injection. (CVE-2026-106583)\nIn ssh-keygen in OpenSSH before 10.6, certificates could have incorrect\nexpiration times because of Daylight Saving mishandling. There can be a\nslightly more severe effect on users in certain Antarctic locations.\n(CVE-2026-106584)\nIn sshd and ssh in OpenSSH before 10.6, there is no check for whether\nthe maximum packet length is exceeded during decompression of highly\ncompressed data. (CVE-2026-106585)\nIn sshd in OpenSSH before 10.6, the restrict keyword (in\nauthorized_keys) was supposed to be applicable to tunnel forwarding but\nwas not, a different vulnerability than CVE-2026-73283.\n(CVE-2026-106586)\nIn sshd in OpenSSH before 10.6, the value \"none\" for a configuration\noption is sometimes interpreted as a filename but was intended to mean\nthat a feature is disabled. (CVE-2026-106587)","dates":{"published":"2026-10-19T16:59:00.000Z","modified":"2026-10-19T17:13:38.453Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"mageia","product":"openssh","name":"openssh","label":"openssh","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/openssh","purlType":"rpm","versions":[{"text":"< 10.0p1-4.1.mga10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 10.0p1-4.1.mga10","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://advisories.mageia.org/MGASA-2026-0521.html","label":"advisories.mageia.org/MGASA-2026-0521.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35876","label":"bugs.mageia.org/show_bug.cgi?id=35876","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FAMKD5T6664L7TA7EBJFLZB2RX3AQYZ/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["WEB"]},{"url":"https://ubuntu.com/security/notices/USN-8533-1","label":"ubuntu.com/security/notices/USN-8533-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I2ZK2T3OFPOIBFAZQAJISQ7EML4PHYVB/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["WEB"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/12/1","label":"www.openwall.com/lists/oss-security/2026/08/12/1","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRB2YTKIEJGFGAKEXYAPCDQSKUFBEI7B/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["WEB"]},{"url":"https://ubuntu.com/security/notices/USN-8721-1","label":"ubuntu.com/security/notices/USN-8721-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8928-1","label":"ubuntu.com/security/notices/USN-8928-1","hostname":"ubuntu.com","tags":["Advisory"]}],"lineage":{"upstream":["CVE-2026-106552","CVE-2026-106553","CVE-2026-106555","CVE-2026-106582","CVE-2026-106583","CVE-2026-106584","CVE-2026-106585","CVE-2026-106586","CVE-2026-106587","CVE-2026-55655","CVE-2026-59995","CVE-2026-59996","CVE-2026-59997","CVE-2026-59998","CVE-2026-59999","CVE-2026-60000","CVE-2026-60001","CVE-2026-60002","CVE-2026-73281","CVE-2026-73282","CVE-2026-73283"],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-19T16:59:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-19T17:13:38.453Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T07:24:19.911Z","stale":false,"partial":false}}