{"id":"CLSA-2026-1792399515","summary":"Fix CVE(s): CVE-2026-106553, CVE-2026-106555, CVE-2026-106583, CVE-2026-106585","details":"   * SECURITY UPDATE: GSSAPI client state and credentials persisted across\n     authentication attempts\n     - debian/patches/CVE-2026-106553-CVE-2026-106555.patch: add\n       ssh_gssapi_cleanup_global_client() and call it before each userauth\n       request in auth2.c and before each pre-auth GSSAPI context setup in\n       monitor.c, and add a userok flag to ssh_gssapi_client so that\n       ssh_gssapi_storecreds() only stores delegated credentials after\n       successful authorization, in gss-serv.c and ssh-gss.h\n     - CVE-2026-106553\n     - CVE-2026-106555\n   * SECURITY UPDATE: Command injection via command-line username\n     - debian/patches/CVE-2026-106583.patch: reject '$' and '\\' anywhere in\n       a command-line supplied user name in valid_ruser(), in ssh.c\n     - CVE-2026-106583\n   * SECURITY UPDATE: Decompression bomb exceeding maximum packet size\n     - debian/patches/CVE-2026-106585.patch: fail uncompress_buffer() once the\n       decompressed output reaches PACKET_MAX_SIZE, in packet.c\n     - CVE-2026-106585","modified":"2026-10-26T09:32:05.632380904Z","published":"2026-10-19T09:10:22Z","upstream":["CVE-2026-106553","CVE-2026-106555","CVE-2026-106583","CVE-2026-106585"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1792399515.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106553"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106555"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106583"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106585"}],"affected":[{"package":{"name":"openssh-client","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openssh-client?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.13+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1792399515.json"}},{"package":{"name":"openssh-server","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openssh-server?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.13+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1792399515.json"}},{"package":{"name":"openssh-sftp-server","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openssh-sftp-server?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.13+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1792399515.json"}},{"package":{"name":"openssh-tests","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openssh-tests?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.13+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1792399515.json"}},{"package":{"name":"ssh","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/ssh?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.13+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1792399515.json"}},{"package":{"name":"ssh-askpass-gnome","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/ssh-askpass-gnome?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.13+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1792399515.json"}}],"schema_version":"1.9.0"}