This update for openssh8.4 fixes the following issues:
- CVE-2026-59995: sftp: a malicious server could change the the location of downloaded files (bsc#1271044).
- CVE-2026-59997: sshd: internal-sftp command lines are silently truncated after the 9th argument (bsc#1271048).
- CVE-2026-59998: sshd: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory
(bsc#1271049).
- CVE-2026-59999: sshd: DisableForwarding=yes didn't override PermitTunnel=yes (bsc#1271052).
- CVE-2026-60000: sshd: pre-authentication denial of service when GSSAPIAuthentication is enabled (bsc#1271053).
- CVE-2026-60001: sshd: honor th
This update for openssh8.4 fixes the following issues:
- CVE-2026-73282: unsynchronized remote forwarding updates in SSH client multiplexing can cause use-after-free
(bsc#1275074).
- CVE-2026-73283: unenforced restriction keywords on tunnel forwarding can allow administrative security policy bypasses
(bsc#1275079).
This update for openssh8.4 fixes the following issues
- CVE-2026-3497: Information disclosure or denial of service due to uninitialized variables (bsc#1259642).
- CVE-2026-35385: a file downloaded by scp may be installed setuid or setgid (bsc#1261427).
- CVE-2026-35388: omitted connection multiplexing confirmation for proxy-mode multiplexing sessions (bsc#1261441).
- CVE-2026-35414: mishandling of authorized_keys principals option (bsc#1261430).
- potential security issue in validating mac (bsc#1264568).
This update for openssh8.4 fixes the following issues:
- CVE-2025-61984: Fixed code execution via control characters in usernames when a ProxyCommand is used (bsc#1251198)
- CVE-2025-61985: Fixed code execution via '\0' character in ssh:// URI when a ProxyCommand is used (bsc#1251199)
This update for openssh8.4 fixes the following issues:
- CVE-2025-26465: Fixed a MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client (bsc#1237040).
Other bugfixes:
- Fix usage of local accelerator cards via openssl-ibmca (bsc#1216474, bsc#1218871).
- Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled) (bsc#1222831).
- Fix hostbased ssh login failing occasionally with 'signature unverified: incorrect signature' by fixing a typo in patch (bsc#1221123).
- For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure (bsc#121478