{"id":"SUSE-SU-2026:4907-1","summary":"Security update for openssh8.4","details":"This update for openssh8.4 fixes the following issues:\n\n- CVE-2026-59995: sftp: a malicious server could change the the location of downloaded files (bsc#1271044).\n- CVE-2026-59997: sshd: internal-sftp command lines are silently truncated after the 9th argument (bsc#1271048).\n- CVE-2026-59998: sshd: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory\n  (bsc#1271049).\n- CVE-2026-59999: sshd: DisableForwarding=yes didn't override PermitTunnel=yes (bsc#1271052).\n- CVE-2026-60000: sshd: pre-authentication denial of service when GSSAPIAuthentication is enabled (bsc#1271053).\n- CVE-2026-60001: sshd: honor the minimum authentication delay (bsc#1271054).\n- CVE-2026-60002: ssh: client-side use-after-free when a server changes its host key during a key reexchange\n  (bsc#1271055).\n","modified":"2026-10-26T20:15:05.602812317Z","published":"2026-10-26T07:21:05Z","related":["CVE-2026-59995","CVE-2026-59997","CVE-2026-59998","CVE-2026-59999","CVE-2026-60000","CVE-2026-60001","CVE-2026-60002"],"upstream":["CVE-2026-59995","CVE-2026-59997","CVE-2026-59998","CVE-2026-59999","CVE-2026-60000","CVE-2026-60001","CVE-2026-60002"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264907-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271044"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271048"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271049"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271052"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271053"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271054"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271055"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-59995"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-59997"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-59998"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-59999"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-60000"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-60001"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-60002"}],"affected":[{"package":{"name":"openssh8.4","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","purl":"pkg:rpm/suse/openssh8.4&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4p1-8.30.1"}]}],"ecosystem_specific":{"binaries":[{"openssh8.4-common":"8.4p1-8.30.1","openssh8.4-fips":"8.4p1-8.30.1","openssh8.4-helpers":"8.4p1-8.30.1","openssh8.4-server":"8.4p1-8.30.1","openssh8.4":"8.4p1-8.30.1","openssh8.4-clients":"8.4p1-8.30.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4907-1.json"}},{"package":{"name":"openssh8.4","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","purl":"pkg:rpm/suse/openssh8.4&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4p1-8.30.1"}]}],"ecosystem_specific":{"binaries":[{"openssh8.4":"8.4p1-8.30.1","openssh8.4-clients":"8.4p1-8.30.1","openssh8.4-common":"8.4p1-8.30.1","openssh8.4-fips":"8.4p1-8.30.1","openssh8.4-helpers":"8.4p1-8.30.1","openssh8.4-server":"8.4p1-8.30.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4907-1.json"}}],"schema_version":"1.9.0"}