RLSA-2026:98073: Moderate: openssh security update
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.
Security Fix(es):
openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw (CVE-2026-59997)
openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory (CVE-2026-59998)
openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts (CVE-2026-60000)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/openssh-debugsourceto a version that resolves this vulnerability.Fixed in 0:9.9p1-33.el10_3.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-askpass-debuginfoto a version that resolves this vulnerability.Fixed in 0:9.9p1-33.el10_3.rocky.0.1 - Upgrade
Upgrade
rocky-linux/opensshto a version that resolves this vulnerability.Fixed in 0:9.9p1-33.el10_3.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-keysign-debuginfoto a version that resolves this vulnerability.Fixed in 0:9.9p1-33.el10_3.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-serverto a version that resolves this vulnerability.Fixed in 0:9.9p1-33.el10_3.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-keycatto a version that resolves this vulnerability.Fixed in 0:9.9p1-33.el10_3.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-clients-debuginfoto a version that resolves this vulnerability.Fixed in 0:9.9p1-33.el10_3.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-debuginfoto a version that resolves this vulnerability.Fixed in 0:9.9p1-33.el10_3.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-server-debuginfoto a version that resolves this vulnerability.Fixed in 0:9.9p1-33.el10_3.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-clientsto a version that resolves this vulnerability.Fixed in 0:9.9p1-33.el10_3.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-askpassto a version that resolves this vulnerability.Fixed in 0:9.9p1-33.el10_3.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-keysignto a version that resolves this vulnerability.Fixed in 0:9.9p1-33.el10_3.rocky.0.1 - Upgrade
Upgrade
rocky-linux/openssh-keycat-debuginfoto a version that resolves this vulnerability.Fixed in 0:9.9p1-33.el10_3.rocky.0.1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What does the published severity vector indicate about exploitation requirements?
The advisory rates the issue at 6.5 (medium) with a network attack vector, low attack complexity, and no required privileges or user interaction. The rated impact is low confidentiality and integrity impact, with no availability impact.
Which deployments should be prioritized for review?
Prioritize Rocky Linux systems with affected OpenSSH packages installed, especially systems using SFTP or GSSAPI authentication. The GSSAPI strict acceptor-check issue specifically references Windows Active Directory environments.