Debian alert DLA-4713-1 (sslh)

From:
             
 
Thorsten Alteholz <debian@alteholz.de>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4713-1] sslh security update
Date:
             
 
Sat, 01 Aug 2026 16:37:28 +0000
Message-ID:
             
 
<437260a8-547e-19d9-2e89-d5aae7eda08b@alteholz.de>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4713-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                    Thorsten Alteholz
August 01, 2026                               https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : sslh
Version        : 1.20-1+deb12u1
CVE ID         : CVE-2025-52936


It was discovered that there was a so-called "link following"
vulnerability in sslh, a protocol multiplexor often used to share
SSH and HTTPS on the same port.


For Debian 12 bookworm, this problem has been fixed in version
1.20-1+deb12u1.

We recommend that you upgrade your sslh packages.

For the detailed security status of sslh please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/sslh

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmpuIMhfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcACgkQlvysDTh7
WEdsLhAAoe9lgtBQ+8Gd2hQekbk9WvpAthjZ+pL27Rrci+zvgDqQyaRauLUN4WZc
nfZhTj8F5AFjuLAIehMMB+EQngOKekn0f07o5aui0dRrU+FcQ6k0YjOmXTW0hOeA
Fa/NhA0eCCJ8MWfKd1wQBHRWh3siqaWZYjWFM4oEdUCg6nDi1inYzaC/c8nwY3e9
hxag6IOLwlLMZimzQ5+/+UCD4gCesrydZvkVlHd3LCUyBy4HEkR0apCWLH2AyraG
oChirS5aG8Z4OLVsa11SC1Bx51/bm3QLcQYLbBTrVMGhJ2LG9E9xY9wJQk1WKKWD
AsgsK90f3yxqN93zg1VamQa37+QfnWxAQZKod1Jzm4HMAE16MFHPjxFhFtfII7UV
8AYSRjgKBFtXIGopf9yak9b6O5V2LjZciXrL3QqDj/lr8+9eeKnmiwa0Icwx1CdY
2ZctclO6YrJcymbsRBjwUDQmDV3pO4Hezck6gVY6KYQN4cLquwXzuxiKD9fAbulx
VxR38dTTdzHoad6Zabg6KMBQYzTt53T7a9zN+ZGRdqTd5r/V7K4j8kTB/AYkWTaA
5KOeGBQi6qJZTNDKGPhNMHllnfdjKoLyzch4KHLSkbszgIfNPSrr4UV+mjNKYiJk
aZd3AHdPjN2Y6YAD6kzAyJxyfyDX2ou5+/0amhwIuzMcEIC4dYA=
=+0D9
-----END PGP SIGNATURE-----