Fedora alert FEDORA-2026-f5a5073561 (opkssh)
| From: | updates--- via package-announce <package-announce@lists.fedoraproject.org> | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 44 Update: opkssh-0.16.0-2.fc44 | |
| Date: | Mon, 31 Aug 2026 17:19:29 +0000 | |
| Message-ID: | <20260831171929.25CC418799BA@bastion01.rdu3.fedoraproject.org> | |
| Archive-link: | Article |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-f5a5073561 2026-08-31 17:15:07.781604+00:00 -------------------------------------------------------------------------------- Name : opkssh Product : Fedora 44 Version : 0.16.0 Release : 2.fc44 URL : https://github.com/openpubkey/opkssh Summary : OpenPubkey SSH Description : OpenPubkey SSH is a tool which enables ssh to be used with OpenID Connect allowing SSH access to be managed via identities like alice@example.com instead of long-lived SSH keys. -------------------------------------------------------------------------------- Update Information: Update the bundled github.com/go-chi/chi/v5 to v5.3.1, which is outside the range affected by CVE-2026-72815, CVE-2026-72816 and CVE-2026-72817 (IP spoofing via chi's RealIP middleware). opkssh bundles only chi's root router package and never the affected middleware package, so the vulnerable code was not actually shipped in any opkssh build. -------------------------------------------------------------------------------- ChangeLog: * Wed Aug 19 2026 Till Hofmann <thofmann@fedoraproject.org> - 0.16.0-2 - Update bundled go-chi/chi to 5.3.1 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2518009 - CVE-2026-72816 opkssh: go-chi/chi: IP Spoofing via RealIP Middleware allows bypassing access controls [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2518009 [ 2 ] Bug #2518054 - CVE-2026-72815 opkssh: go-chi chi: IP spoofing via X-Forwarded-For header allows bypass of access controls [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2518054 [ 3 ] Bug #2518198 - CVE-2026-72817 opkssh: go-chi/chi: IP spoofing via X-Forwarded-For header manipulation [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2518198 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-f5a5073561' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgr... All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-cond... List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/package-ann... Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new