Ubuntu alert USN-8577-1 (openssh)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8577-1] OpenSSH vulnerability
Date:
             
 
Tue, 21 Jul 2026 17:52:27 +0000
Message-ID:
             
 
<E1wmEdn-000596-76@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8577-1
July 21, 2026

openssh vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 LTS

Summary:

OpenSSH could allow unintended access to network services.

Software Description:
- openssh: secure shell (SSH) for secure access to remote machines

Details:

USN-8222-1 fixed a vulnerability in OpenSSH. This update provides the
corresponding fix for Ubuntu 16.04 LTS.

Original advisory details:

 Vladimir Tokarev discovered that OpenSSH incorrectly handled certificates
 with the principal name containing a comma character when using user-trusted
 CA keys in authorized_keys and an authorized_keys principals="" option
 that lists more than one principal. This could result in inappropriate
 principal matching, contrary to expectations. (CVE-2026-35414)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS
  openssh-server                  1:7.2p2-4ubuntu2.10+esm9
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8577-1
  CVE-2026-35414


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpfiHsACgkQcpJm3tlz
hgF4Mg//X1sMiNx7CVXSiYy/e7Xro1JQ1W68bn/oXYIkDiS/Hfgf8FQy+oIVM8Ay
/vEDkCgo4w+W2AvRdRrTyJVRMhzl5yqbRPNuG8bXsRMN+rL6k0nduFKkttPeEcTV
FsFND+7oRGJuja4uIKEe85LvOKeaztpASl78d+X3RmoznP4LC+sfFh3h/l+UBn/O
2jNcxu9q8If5gsvjWD/BmuAn3DjlgIYh0ysRk0nd9RDlXM4gAFpWJP59TCi0RcPE
RgKLprmzqyShQDece7aF/kXfHcq7GaoyMuENGz77DO6+LhhEJTJz2YDNQfiPzR5T
RunlSNXpsLWIQizluie2ysekIG1hhvrjA7mCnzRSocDEcRaR97t1QegPvNTbEc07
Z7YslCJ5grYLfshL3zz1bE20jsBbsIKrl0JzT5HUiX7RrhA+PCFzfAlubDbhbkfc
ACjfqf3BNIXWw0AVaj20Hrdc+oD8dKPJaNTu/iJAspTzmiIHu8SSG8jR968PRl0i
eBtq1zc8dXA2kt5WPgLa5YroMcXhMwQ4PiXx+Et4LGhrLHTyEaoyWqtIGGaZnBY6
61C1vVZokkKbo3OXg++sf2ihEoY8sh2nOdYQMFNUWjsN+TFIke9Bz/aGtHALb6QQ
Y0YAUmVU4rrnJPZIQvU5ai9pRH4IoIo2cem3kBD67tpmqeFPPBM=
=7Fe9
-----END PGP SIGNATURE-----