CVE-2025-61984: Low severity OpenSSH OpenSSH vulnerability
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenSSHto a version that resolves this vulnerability.Fixed in 10.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61984?
CVE-2025-61984 is classified as a potential security vulnerability that allows code execution via control characters in usernames.
How do I fix CVE-2025-61984?
To mitigate CVE-2025-61984, upgrade OpenSSH to version 10.1 or later to ensure that control characters in usernames are not allowed.
Which versions of OpenSSH are affected by CVE-2025-61984?
CVE-2025-61984 affects OpenSSH versions prior to 10.1.
What is the potential impact of CVE-2025-61984?
The potential impact of CVE-2025-61984 includes unauthorized code execution based on user input from untrusted sources.
How does CVE-2025-61984 exploit OpenSSH functionality?
CVE-2025-61984 exploits the ProxyCommand feature in OpenSSH by allowing control characters in usernames, which can be sourced from the command line or configuration files.