https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 07:54:22 +0000 https://db.gcve.eu/vuln/cve-2026-35385 <p><strong>Affected:</strong> OpenBSD OpenSSH, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service and 22 more</p> <p>In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users&#39; expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).</p> <p><strong>Affected:</strong> OpenBSD OpenSSH, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service and 22 more</p> <p>In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users&#39; expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).</p> https://db.gcve.eu/vuln/cve-2026-35385 https://db.gcve.eu/vuln/usn-8222-1 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: openssh, Ubuntu:24.04:LTS: openssh, Ubuntu:25.10: openssh, Ubuntu:26.04:LTS: openssh</p> <p>Christos Papakonstantinou discovered that the OpenSSH scp tool incorrectly handled the legacy scp protocol (-O) option. This could result in certain files being installed setuid or setgid, contrary to expectations. (CVE-2026-35385)</p> <p>Florian Kohnhäuser discovered that OpenSSH incorrectly handled shell metacharacters in usernames within a command line. When untrusted usernames and non-default configurations using % in ssh_config are being used, an attacker could possibly use this issue to execute arbitrary code. (CVE-2026-35386)</p> <p>Christos Papakonstantinou discovered that OpenSSH incorrectly handled parsing the PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms options. This could result in unintended ECDSA algorithms being used, contrary to expectations. (CVE-2026-35387)</p> <p>Michalis Vasileiadis discovered that OpenSSH incorrectly handled proxy-mode multiplexing sessions. This could result in no confirmation being asked, contrary to expectations. (CVE-2026-35388)</p> <p>Vladimir Tokarev discovered that OpenSSH incorrectly handled certificates with the principal name containing a comma character when using user-trusted CA keys in authorized_keys and an authorized_keys principals=&#34;&#34; option that lists more than one principal. This could result in inappropriate principal matching, contrary to expectations. (CVE-2026-35414)</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: openssh, Ubuntu:24.04:LTS: openssh, Ubuntu:25.10: openssh, Ubuntu:26.04:LTS: openssh</p> <p>Christos Papakonstantinou discovered that the OpenSSH scp tool incorrectly handled the legacy scp protocol (-O) option. This could result in certain files being installed setuid or setgid, contrary to expectations. (CVE-2026-35385)</p> <p>Florian Kohnhäuser discovered that OpenSSH incorrectly handled shell metacharacters in usernames within a command line. When untrusted usernames and non-default configurations using % in ssh_config are being used, an attacker could possibly use this issue to execute arbitrary code. (CVE-2026-35386)</p> <p>Christos Papakonstantinou discovered that OpenSSH incorrectly handled parsing the PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms options. This could result in unintended ECDSA algorithms being used, contrary to expectations. (CVE-2026-35387)</p> <p>Michalis Vasileiadis discovered that OpenSSH incorrectly handled proxy-mode multiplexing sessions. This could result in no confirmation being asked, contrary to expectations. (CVE-2026-35388)</p> <p>Vladimir Tokarev discovered that OpenSSH incorrectly handled certificates with the principal name containing a comma character when using user-trusted CA keys in authorized_keys and an authorized_keys principals=&#34;&#34; option that lists more than one principal. This could result in inappropriate principal matching, contrary to expectations. (CVE-2026-35414)</p> https://db.gcve.eu/vuln/usn-8222-1