{"id":"SUSE-SU-2026:24382-1","summary":"Security update for openssh","details":"This update for openssh fixes the following issues:\n\n- CVE-2026-59995: sftp: a malicious server could change the the location of downloaded files (bsc#1271044).\n- CVE-2026-59996: scp: a malicious server could write files to the parent directory of the intended target directory\n  (bsc#1271046).\n- CVE-2026-59997: sshd: internal-sftp command lines are silently truncated after the 9th argument (bsc#1271048).\n- CVE-2026-59998: sshd: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory\n  (bsc#1271049).\n- CVE-2026-59999: sshd: DisableForwarding=yes didn't override PermitTunnel=yes (bsc#1271052).\n- CVE-2026-60000: sshd: pre-authentication denial of service when GSSAPIAuthentication is enabled (bsc#1271053).\n- CVE-2026-60001: sshd: honor the minimum authentication delay (bsc#1271054).\n- CVE-2026-60002: ssh: client-side use-after-free when a server changes its host key during a key reexchange\n  (bsc#1271055).\n- CVE-2026-73281: refused binding requests on locked SSH agents can allow destination restriction bypasses\n  (bsc#1275075).\n- CVE-2026-73282: unsynchronized remote forwarding updates in SSH client multiplexing can cause use-after-free\n  (bsc#1275074).\n- CVE-2026-73283: unenforced restriction keywords on tunnel forwarding can allow administrative security policy bypasses\n  (bsc#1275079).\n","modified":"2026-10-27T17:23:19.462025353Z","published":"2026-10-23T11:58:00Z","related":["CVE-2026-59995","CVE-2026-59996","CVE-2026-59997","CVE-2026-59998","CVE-2026-59999","CVE-2026-60000","CVE-2026-60001","CVE-2026-60002","CVE-2026-73281","CVE-2026-73282","CVE-2026-73283"],"upstream":["CVE-2026-59995","CVE-2026-59996","CVE-2026-59997","CVE-2026-59998","CVE-2026-59999","CVE-2026-60000","CVE-2026-60001","CVE-2026-60002","CVE-2026-73281","CVE-2026-73282","CVE-2026-73283"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624382-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259462"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271044"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271046"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271048"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271049"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271052"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271053"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271054"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271055"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275074"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275075"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275079"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-59995"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-59996"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-59997"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-59998"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-59999"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-60000"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-60001"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-60002"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-73281"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-73282"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-73283"}],"affected":[{"package":{"name":"openssh","ecosystem":"SUSE:Linux Micro 6.1","purl":"pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Micro%206.1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-slfo.1.1_7.1"}]}],"ecosystem_specific":{"binaries":[{"openssh":"9.6p1-slfo.1.1_7.1","openssh-clients":"9.6p1-slfo.1.1_7.1","openssh-common":"9.6p1-slfo.1.1_7.1","openssh-fips":"9.6p1-slfo.1.1_7.1","openssh-server":"9.6p1-slfo.1.1_7.1","openssh-server-config-rootlogin":"9.6p1-slfo.1.1_7.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24382-1.json"}}],"schema_version":"1.9.2"}