CLSA-2026-1792513900
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792513900.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1792513900
- Upstream
- Published
- 2026-10-20T16:31:49Z
- Modified
- 2026-10-26T09:43:51Z
- Summary
- openssh: Fix of CVE-2026-106587
- Details
-
- CVE-2026-106587: sshd did not clear AuthorizedPrincipalsFile, TrustedUserCAKeys and Banner when a Match block set them to "none", so the global value stayed in effect before authentication; clear them in the pre-auth part of copy_set_server_options(). Backport upstream commit 526fd277.
- CVE-2026-106586: sshd dropped the authorized_keys "restrict" flag when merging key and certificate options, which could re-enable features such as tunnel forwarding; OR the restricted flag in sshauthopt_merge(). Backport upstream commit 991f1f31.
- CVE-2026-106552: sftp(1) accepted an empty file name from a server directory listing and could pick ".." or the local root as an implicit download destination; reject empty names and map ".." and remote roots to ".". Backport upstream commit c07ea218.
- CVE-2026-106584: ssh-keygen(1) converted certificate validity dates without letting mktime() decide DST, giving expiry times off by an hour; set tm_isdst to -1 in parse_absolute_time(). Backport upstream commit aef20dfe.
- CVE-2026-106582: compressed SSH sessions used the zlib LZ77 dictionary coder, exposing a compression side channel; use Huffman-only compression for outgoing packets. Backport upstream commit 1d5340fc.
- References