kritik
CVE-2026-60002
openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Red Hat7.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Julia9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Julia, Photon OS. Daha düşük diyenler: Red Hat (yüksek), AlmaLinux (yüksek), Azure Linux (yüksek), Oracle (yüksek), Rocky Linux (yüksek), Amazon (orta), Ubuntu (orta).
Açıklama
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | OpenSSH_jll | 10.4.1+0 |
| Photon OS 4.0 | openssh, openssh-clients, openssh-server ve 1 tane daha | 8.9p1-16.ph4 |
| Photon OS 5.0 | openssh, openssh-clients, openssh-server ve 1 tane daha | 10.4p1-1.ph5 |
| alma 10 | openssh, openssh-askpass, openssh-clients ve 3 tane daha | 9.9p1-25.el10_2.alma.1 |
| alma 9 | openssh, openssh-askpass, openssh-clients ve 3 tane daha | 9.9p1-9.el9_8.alma.1 ve 1 tane daha |
| alpine 3.24 | openssh | 10.3_p1-r1 |
| amazon linux 2023 | openssh, openssh-clients, openssh-clients-debuginfo ve 10 tane daha | 9.9p1-10.amzn2023.0.1 ve 1 tane daha |
| Azure Linux 3.0 | openssh | 0:9.8p1-9.azl3 |
| debian 11 | openssh | düzeltme belirtilmemiş |
| debian 12 | openssh | düzeltme belirtilmemiş |
| debian 13 | openssh | düzeltme belirtilmemiş |
| debian 14 | openssh | 1:10.4p1-1 |
43 kaynaktaki 141 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | OpenSSH_jll | 10.4.1+0 |
| Photon OS 4.0 | openssh | 8.9p1-16.ph4 |
| Photon OS 4.0 | openssh-clients | 8.9p1-16.ph4 |
| Photon OS 4.0 | openssh-server | 8.9p1-16.ph4 |
| Photon OS 4.0 | openssh-socket | 8.9p1-16.ph4 |
| Photon OS 5.0 | openssh | 10.4p1-1.ph5 |
| Photon OS 5.0 | openssh-clients | 10.4p1-1.ph5 |
| Photon OS 5.0 | openssh-server | 10.4p1-1.ph5 |
| Photon OS 5.0 | openssh-socket | 10.4p1-1.ph5 |
| alma 10 | openssh | 9.9p1-25.el10_2.alma.1 |
| alma 10 | openssh-askpass | 9.9p1-25.el10_2.alma.1 |
| alma 10 | openssh-clients | 9.9p1-25.el10_2.alma.1 |
| alma 10 | openssh-keycat | 9.9p1-25.el10_2.alma.1 |
| alma 10 | openssh-keysign | 9.9p1-25.el10_2.alma.1 |
| alma 10 | openssh-server | 9.9p1-25.el10_2.alma.1 |
| alma 9 | openssh | 9.9p1-9.el9_8.alma.1 |
| alma 9 | openssh-askpass | 9.9p1-9.el9_8.alma.1 |
| alma 9 | openssh-clients | 9.9p1-9.el9_8.alma.1 |
| alma 9 | openssh-keycat | 9.9p1-9.el9_8.alma.1 |
| alma 9 | openssh-server | 9.9p1-9.el9_8.alma.1 |
| alma 9 | pam_ssh_agent_auth | 0.10.4-7.9.el9_8.alma.1 |
| alpine 3.24 | openssh | 10.3_p1-r1 |
| amazon linux 2023 | openssh | 9.9p1-10.amzn2023.0.1 |
| amazon linux 2023 | openssh-clients | 9.9p1-10.amzn2023.0.1 |
| amazon linux 2023 | openssh-clients-debuginfo | 9.9p1-10.amzn2023.0.1 |
| amazon linux 2023 | openssh-debuginfo | 9.9p1-10.amzn2023.0.1 |
| amazon linux 2023 | openssh-debugsource | 9.9p1-10.amzn2023.0.1 |
| amazon linux 2023 | openssh-keycat | 9.9p1-10.amzn2023.0.1 |
| amazon linux 2023 | openssh-keycat-debuginfo | 9.9p1-10.amzn2023.0.1 |
| amazon linux 2023 | openssh-server | 9.9p1-10.amzn2023.0.1 |
| amazon linux 2023 | openssh-server-debuginfo | 9.9p1-10.amzn2023.0.1 |
| amazon linux 2023 | openssh-sk-dummy | 9.9p1-10.amzn2023.0.1 |
| amazon linux 2023 | openssh-sk-dummy-debuginfo | 9.9p1-10.amzn2023.0.1 |
| amazon linux 2023 | pam_ssh_agent_auth | 0.10.4-9.10.amzn2023.0.1 |
| amazon linux 2023 | pam_ssh_agent_auth-debuginfo | 0.10.4-9.10.amzn2023.0.1 |
| Azure Linux 3.0 | openssh | 0:9.8p1-9.azl3 |
| debian 11 | openssh | düzeltme belirtilmemiş |
| debian 12 | openssh | düzeltme belirtilmemiş |
| debian 13 | openssh | düzeltme belirtilmemiş |
| debian 14 | openssh | 1:10.4p1-1 |
| echo | openssh | 1:10.4p1-1 |
| Oracle Linux 9 | openssh | 9.9p1-9.0.1.el9_8 |
| Oracle Linux 9 | openssh-askpass | 9.9p1-9.0.1.el9_8 |
| Oracle Linux 9 | openssh-clients | 9.9p1-9.0.1.el9_8 |
| Oracle Linux 9 | openssh-keycat | 9.9p1-9.0.1.el9_8 |
| Oracle Linux 9 | openssh-server | 9.9p1-9.0.1.el9_8 |
| Oracle Linux 9 | pam_ssh_agent_auth | 0.10.4-7.9.0.1.el9_8 |
| rapidfort alma 10 | openssh | 0:9.9p1-25.el10_2.alma.1 |
| rapidfort alma 10 | openssh-askpass | 9.9p1-25.el10_2.alma.1 |
| rapidfort alma 10 | openssh-clients | 0:9.9p1-25.el10_2.alma.1 |
| rapidfort alma 10 | openssh-keycat | 9.9p1-25.el10_2.alma.1 |
| rapidfort alma 10 | openssh-keysign | 9.9p1-25.el10_2.alma.1 |
| rapidfort alma 10 | openssh-server | 9.9p1-25.el10_2.alma.1 |
| rapidfort alma 9 | openssh | 0:9.9p1-9.el9_8.alma.1 |
| rapidfort alma 9 | openssh-askpass | 9.9p1-9.el9_8.alma.1 |
| rapidfort alma 9 | openssh-clients | 0:9.9p1-9.el9_8.alma.1 |
| rapidfort alma 9 | openssh-keycat | 9.9p1-9.el9_8.alma.1 |
| rapidfort alma 9 | openssh-server | 9.9p1-9.el9_8.alma.1 |
| rapidfort alma 9 | pam_ssh_agent_auth | 0.10.4-7.9.el9_8.alma.1 |
| rapidfort alpine 3.20 | openssh | 10.3_p1-r1 |
| rapidfort alpine 3.21 | openssh | 10.3_p1-r1 |
| rapidfort alpine 3.22 | openssh | 10.3_p1-r1 |
| rapidfort alpine 3.23 | openssh | 10.3_p1-r1 |
| rapidfort alpine 3.24 | openssh | 10.3_p1-r1 |
| rapidfort amazon linux 2023 | openssh | 9.9p1-10.amzn2023.0.1 |
| rapidfort amazon linux 2023 | openssh-clients | 9.9p1-10.amzn2023.0.1 |
| rapidfort amazon linux 2023 | openssh-keycat | 9.9p1-10.amzn2023.0.1 |
| rapidfort amazon linux 2023 | pam_ssh_agent_auth | 0.10.4-9.10.amzn2023.0.1 |
| rapidfort debian | rf-openssh | 1:10.4p1-11rfubu1 |
| rapidfort debian 12 | openssh | 1:10.4p1-1 |
| rapidfort debian 12 | rf-openssh | 1:10.4p1-1 |
| rapidfort debian 13 | openssh | 1:10.4p1-1 |
| rapidfort debian 13 | rf-openssh | 1:10.4p1-1 |
| rapidfort fedora 41 | openssh | 0:9.9p1-5.fc41 |
| rapidfort fedora 41 | openssh-clients | 0:9.9p1-5.fc41 |
| rapidfort fedora 41 | openssh-server | 0:9.9p1-5.fc41 |
| rapidfort fedora 41 | rf-openssh | 0:9.9p1-5.fc41 |
| rapidfort fedora 41 | rf-openssh-clients | 0:9.9p1-5.fc41 |
| rapidfort fedora 41 | rf-openssh-server | 0:9.9p1-5.fc41 |
| rapidfort fedora 42 | openssh | 0:9.9p1-15.fc42 |
| rapidfort fedora 42 | openssh-clients | 0:9.9p1-15.fc42 |
| rapidfort fedora 42 | openssh-server | 0:9.9p1-15.fc42 |
| rapidfort fedora 42 | rf-openssh | 0:9.9p1-15.fc42 |
| rapidfort fedora 42 | rf-openssh-clients | 0:9.9p1-15.fc42 |
| rapidfort fedora 42 | rf-openssh-server | 0:9.9p1-15.fc42 |
| rapidfort fedora 43 | openssh | 0:10.0p1-11.fc43 |
| rapidfort fedora 43 | openssh-askpass | 10.0p1-11.fc43 |
| rapidfort fedora 43 | openssh-clients | 0:10.0p1-11.fc43 |
| rapidfort fedora 43 | openssh-keycat | 10.0p1-11.fc43 |
| rapidfort fedora 43 | openssh-keysign | 10.0p1-11.fc43 |
| rapidfort fedora 43 | openssh-server | 0:10.0p1-11.fc43 |
| rapidfort fedora 43 | openssh-sk-dummy | 10.0p1-11.fc43 |
| rapidfort fedora 43 | rf-openssh | 0:10.0p1-11.fc43 |
| rapidfort fedora 43 | rf-openssh-askpass | 10.0p1-11.fc43 |
| rapidfort fedora 43 | rf-openssh-clients | 0:10.0p1-11.fc43 |
| rapidfort fedora 43 | rf-openssh-keycat | 10.0p1-11.fc43 |
| rapidfort fedora 43 | rf-openssh-keysign | 10.0p1-11.fc43 |
| rapidfort fedora 43 | rf-openssh-server | 0:10.0p1-11.fc43 |
| rapidfort fedora 43 | rf-openssh-sk-dummy | 10.0p1-11.fc43 |
| rapidfort Oracle Linux 10 | openssh | 0:9.9p1-25.0.1.el10_2 |
| rapidfort Oracle Linux 10 | openssh-askpass | 0:9.9p1-25.0.1.el10_2 |
| rapidfort Oracle Linux 10 | openssh-clients | 0:9.9p1-25.0.1.el10_2 |
| rapidfort Oracle Linux 10 | openssh-keycat | 0:9.9p1-25.0.1.el10_2 |
| rapidfort Oracle Linux 10 | openssh-keysign | 0:9.9p1-25.0.1.el10_2 |
| rapidfort Oracle Linux 10 | openssh-server | 0:9.9p1-25.0.1.el10_2 |
| rapidfort Oracle Linux 9 | openssh | 0:9.9p1-9.0.1.el9_8 |
| rapidfort Oracle Linux 9 | openssh-askpass | 0:9.9p1-9.0.1.el9_8 |
| rapidfort Oracle Linux 9 | openssh-clients | 0:9.9p1-9.0.1.el9_8 |
| rapidfort Oracle Linux 9 | openssh-keycat | 0:9.9p1-9.0.1.el9_8 |
| rapidfort Oracle Linux 9 | openssh-server | 0:9.9p1-9.0.1.el9_8 |
| rapidfort Oracle Linux 9 | pam_ssh_agent_auth | 0:0.10.4-7.9.0.1.el9_8 |
| rapidfort rocky 9 | openssh | 0:9.9p1-9.el9_8.rocky.0.1 |
| rapidfort rocky 9 | openssh-askpass | 0:9.9p1-9.el9_8.rocky.0.1 |
| rapidfort rocky 9 | openssh-clients | 0:9.9p1-9.el9_8.rocky.0.1 |
| rapidfort rocky 9 | openssh-keycat | 0:9.9p1-9.el9_8.rocky.0.1 |
| rapidfort rocky 9 | openssh-server | 0:9.9p1-9.el9_8.rocky.0.1 |
| rapidfort rocky 9 | pam_ssh_agent_auth | 0:0.10.4-7.9.el9_8.rocky.0.1 |
| rapidfort ubuntu | openssh | 1:10.4p1-11rfubu1 |
| rapidfort ubuntu | rf-openssh | 1:10.4p1-11rfubu1 |
| rapidfort ubuntu 20.04 | openssh | 1:9.6p1-3ubuntu13.18 |
| rapidfort ubuntu 20.04 | rf-openssh | 1:9.6p1-3ubuntu13.18 |
| rapidfort ubuntu 22.04 | openssh | 1:9.6p1-3ubuntu13.18 |
| rapidfort ubuntu 22.04 | rf-openssh | 1:9.6p1-3ubuntu13.18 |
| rapidfort ubuntu 24.04 | openssh | 1:9.6p1-3ubuntu13.18 |
| rapidfort ubuntu 24.04 | rf-openssh | 1:9.6p1-3ubuntu13.18 |
| Red Hat | openshift/ose-rhel-coreos-9 | düzeltme belirtilmemiş |
| rocky 10 | openssh | 0.0.0 |
| rocky 10 | openssh-clients | 0.0.0 |
| rocky 10 | openssh-keycat | 0.0.0 |
| rocky 10 | openssh-server | 0.0.0 |
| rocky 9 | openssh | 9.9p1-9.el9_8.rocky.0.1 |
| rocky 9 | openssh-clients | 9.9p1-9.el9_8.rocky.0.1 |
| rocky 9 | openssh-keycat | 9.9p1-9.el9_8.rocky.0.1 |
| rocky 9 | openssh-server | 9.9p1-9.el9_8.rocky.0.1 |
| seal Red Hat 6 | openssh | 5.3p1-124.el6_10+sp999 |
| seal Red Hat 6 | seal-openssh | 5.3p1-124.el6_10+sp999 |
| seal Red Hat 7 | openssh | 7.4p1-23.0.3.el7_9+sp999 |
| seal Red Hat 7 | seal-openssh | 7.4p1-23.0.3.el7_9+sp999 |
| ubuntu 22.04 | openssh | 1:8.9p1-3ubuntu0.16 |
| ubuntu 24.04 | openssh | 1:9.6p1-3ubuntu13.18 |
| ubuntu 26.04 | openssh | 1:10.2p1-2ubuntu3.4 |
Referanslar
- https://access.redhat.com/errata/RHSA-2026:47756
- https://access.redhat.com/security/cve/CVE-2026-60002
- https://bugzilla.redhat.com/2462250
- https://bugzilla.redhat.com/2462351
- https://bugzilla.redhat.com/2462493
- https://bugzilla.redhat.com/2497936
- https://bugzilla.redhat.com/2497944
- https://bugzilla.redhat.com/show_bug.cgi?id=2462250
29 referansın hepsi
- https://bugzilla.redhat.com/show_bug.cgi?id=2462351
- https://bugzilla.redhat.com/show_bug.cgi?id=2462493
- https://bugzilla.redhat.com/show_bug.cgi?id=2497936
- https://bugzilla.redhat.com/show_bug.cgi?id=2497944
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55653
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55654
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55655
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59996
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60002
- https://errata.almalinux.org/9/ALSA-2026-47756.html
- https://errata.rockylinux.org/RLSA-2026:47756
- https://github.com/advisories/GHSA-gp5v-jg37-fvg6
- https://linux.oracle.com/cve/CVE-2026-60002.html
- https://linux.oracle.com/errata/ELSA-2026-47757.html
- https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2
- https://nvd.nist.gov/vuln/detail/CVE-2026-60002
- https://ubuntu.com/security/notices/USN-8533-1
- https://www.cve.org/CVERecord?id=CVE-2026-60002
- https://www.openssh.org/releasenotes.html#10.4p1
- https://www.openwall.com/lists/oss-security/2026/07/06/5