SUSE-SU-2026:3339-1: apache-sshd&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:3339-1 is a vulnerability in apache-sshd&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 28-07-2026
   PublishedVulnerability first disclosed.
2. 28-07-2026
   Last modifiedVulnerability information updated.

Description

Security update for apache-sshd This update for apache-sshd fixes the following issues: Update to upstream version 2.19.0. Security issues fixed: - CVE-2026-56452: remote users can use SCP to send filenames that lead to arbitrary file writes due to a path traversal issue in the `sshd-scp` component of Apache MINA SSHD. (bsc#1272158). - CVE-2026-56623: remote users can obtain access to git repositories outside of the configured server-side root directory on Windows systems due to path traversal issue in `org.apache.sshd:sshd-git` (bsc#1271993). - CVE-2026-56624: users can authenticate with certificates containing the `force-command` option but still execute other commands due to improper validation of certificate options in Apache MINA SSHD (bsc#1271992). - CVE-2026-58624: remote execution of JGit commands can lead to arbitrary file writes due to improper input validation in `sshd-git` of Apache MINA SSHD (bsc#1271991). Other updates and bugfixes: - Version 2.19.0: * Bug Fixes + GH-899 Fix ProcessShellFactory on Linux. + GH-902 Fix client-side handling of sk-* public key signatures (also in the agent interfaces). + Limit size of decompressed SSH packets. + Improve checking SSH user certificates in public-key authentication. + Improve handling of repository paths in sshd-git on Windows. + Validate file names in SCP. + Escape newlines in filenames in the SCP protocol. + Restrict JGit commands accessible via GitPgmCommandFactory in sshd-git.

No weakness data has been published for this record.