Ubuntu alert USN-8533-1 (openssh)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8533-1] OpenSSH vulnerabilities
Date:
             
 
Mon, 13 Jul 2026 14:00:41 +0000
Message-ID:
             
 
<E1wjHD7-00071M-P7@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8533-1
July 13, 2026

openssh vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in OpenSSH.

Software Description:
- openssh: secure shell (SSH) for secure access to remote machines

Details:

It was discovered that OpenSSH sftp did not properly constrain the location
of downloaded files when connecting to an attacker-controlled server. An
attacker could possibly use this issue to write files to unintended
locations on the file system. (CVE-2026-59995)

It was discovered that OpenSSH scp could place files in the parent
directory of the intended destination when copying between two remote
hosts. An attacker could possibly use this issue to write files to
unintended locations. (CVE-2026-59996)

It was discovered that OpenSSH internal-sftp only recognized the first nine
command-line arguments, This could result in certain security-sensitive
arguments being ignored, contrary to expectations. (CVE-2026-59997)

It was discovered that OpenSSH had undocumented behaviour regarding the
GSSAPIStrictAcceptorCheck option in environments using Windows Active
Directory. The documentation has been updated to clarify use of the option.
(CVE-2026-59998)

It was discovered that OpenSSH did not properly enforce precedence of
DisableForwarding=yes over PermitTunnel=yes in server configurations. This
could possibly result in intended network forwarding restrictions being
bypassed, contrary to expectations. (CVE-2026-59999)

It was discovered that OpenSSH mishandled the MaxAuthTries limit for GSSAPI
authentication. A remote attacker could use this issue to perform excessive
authentication attempts. (CVE-2026-60000)

It was discovered that OpenSSH did not always honour the minimum
authentication delay. An attacker could possibly use this issue to perform
brute-force attacks more efficiently. (CVE-2026-60001)

It was discovered that the OpenSSH client had a use-after-free
vulnerability when a server changed its host key during a key re-exchange.
An attacker able to intercept communications could possibly use this issue
to execute arbitrary code or obtain sensitive information. (CVE-2026-60002)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  openssh-client                  1:10.2p1-2ubuntu3.4
  openssh-server                  1:10.2p1-2ubuntu3.4

Ubuntu 24.04 LTS
  openssh-client                  1:9.6p1-3ubuntu13.18
  openssh-server                  1:9.6p1-3ubuntu13.18

Ubuntu 22.04 LTS
  openssh-client                  1:8.9p1-3ubuntu0.16
  openssh-server                  1:8.9p1-3ubuntu0.16

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8533-1
  CVE-2026-59995, CVE-2026-59996, CVE-2026-59997, CVE-2026-59998,
  CVE-2026-59999, CVE-2026-60000, CVE-2026-60001, CVE-2026-60002

Package Information:
  https://launchpad.net/ubuntu/+source/openssh/1:10.2p1-2ub...
  https://launchpad.net/ubuntu/+source/openssh/1:9.6p1-3ubu...
  https://launchpad.net/ubuntu/+source/openssh/1:8.9p1-3ubu...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpU7fQACgkQcpJm3tlz
hgGrpRAAh1q3Dvjs6e8GTY2kGctbegZcBv3i/bJcCoJL8K9ysUlQLKfyb8y1J24Q
QXOzk/RAz0cI+68AtlbMCE0DdbwwwEnW/27qQSVlHCiy2QUbmzVE/KuXaeqEBbZF
Cs4IDM7I7R1M3ngCQNuazD3lakwI6u8S8NIVM8GG7kDJnvXUEpC3zGexweD0PDqP
ZymnEJPi/18mtTS1h19LyO+tymcouTgGb5uyZy+G2sEO6J7F0i2XisNxOfFrJxUJ
kUKQq5Xs4wsO/X9oDNrzCtxeRzjkhLGSn/8fPh0xWndQOAY5YmIwj+Coa+y2bhvE
JNXXBpU5Eu6o//5a+3zQSDSj5x7ZfXW3ixJRWk5rXl5dOPkxviuDDvjQ75rD0Jm5
T+f+H2m/6813Y41+Haa/fIaTfJ/4yYSYBznIkxahSmyEplNEfuXhFjBw2lO8L6dN
+NKzFzk65bj4R74hyRKv8c6fOMgWDvyfiZthwhIIIAMin+4Ayf/5BvDE0D4mj3sQ
DiDqo/XmbIqpncUcSKJHZ5nfiWokt2W1koe+fDji70JH9GFXnV7uRQkNvAMmIgk1
pX5jRATKZmbd+HOx9d//USKv0X8DRHF78pSH4YTrwE/RJMSxriHW8KZk6bBZJay4
Due/u5bKt3pi2fYNsnlaoQqdvteWrlNhM6YxTgNUYlFSSht51uk=
=24/5
-----END PGP SIGNATURE-----