Red Hat Security Advisory: openssh security update

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products91

• Red Hat Enterprise Linux AppStream (v. 10)
• Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-0:9.9p1-11.el10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-0:9.9p1-11.el10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-0:9.9p1-11.el10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-0:9.9p1-11.el10.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-0:9.9p1-11.el10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-askpass-0:9.9p1-11.el10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
• openssh-askpass-0:9.9p1-11.el10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
• openssh-askpass-0:9.9p1-11.el10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
• openssh-askpass-0:9.9p1-11.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
• openssh-askpass-debuginfo-0:9.9p1-11.el10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
• openssh-askpass-debuginfo-0:9.9p1-11.el10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-askpass-debuginfo-0:9.9p1-11.el10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
• openssh-askpass-debuginfo-0:9.9p1-11.el10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-askpass-debuginfo-0:9.9p1-11.el10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
• openssh-askpass-debuginfo-0:9.9p1-11.el10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-askpass-debuginfo-0:9.9p1-11.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
• openssh-askpass-debuginfo-0:9.9p1-11.el10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-clients-0:9.9p1-11.el10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-clients-0:9.9p1-11.el10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-clients-0:9.9p1-11.el10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-clients-0:9.9p1-11.el10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-clients-debuginfo-0:9.9p1-11.el10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
• openssh-clients-debuginfo-0:9.9p1-11.el10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-clients-debuginfo-0:9.9p1-11.el10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
• openssh-clients-debuginfo-0:9.9p1-11.el10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-clients-debuginfo-0:9.9p1-11.el10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
• openssh-clients-debuginfo-0:9.9p1-11.el10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
• openssh-clients-debuginfo-0:9.9p1-11.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
• +61 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, explicitly disable X11 and agent forwarding in your SSH configuration (sshd_config) using: X11Forwarding no AllowAgentForwarding no

🔗 References (10)

• selfhttps://access.redhat.com/errata/RHSA-2025:20126
• externalhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.1_release_notes/index
• externalhttps://access.redhat.com/security/updates/classification/#moderate
• externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2358767
• externalhttps://issues.redhat.com/browse/RHEL-40790
• externalhttps://issues.redhat.com/browse/RHEL-58252
• externalhttps://issues.redhat.com/browse/RHEL-68124
• externalhttps://issues.redhat.com/browse/RHEL-68346
• externalhttps://issues.redhat.com/browse/RHEL-93957
• selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_20126.json