Alerts This Week
Warning Icon 1 626
Alerts This Week
Warning Icon 1 626

Warning: Undefined array key "Description" in /var/www/www.linuxsecurity.com-443/html/lsadvisories/lsadvisories.php on line 220

Fedora 44 openssh Important Update 2026-93679cc7c2 Privilege Escalation

fedora
Calendar Grey April 25, 2026
Dist Fedora Esm H88
Important Fedora 44 openssh update addresses multiple vulnerabilities including privilege escalation and information disclosure risks.
CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexi...

Summary

SSH (Secure SHell) is a program for logging into and executing

commands on a remote machine. SSH is intended to replace rlogin and

rsh, and to provide secure encrypted communications between two

untrusted hosts over an insecure network. X11 connections and

arbitrary TCP/IP ports can also be forwarded over the secure channel.

OpenSSH is OpenBSD's version of the last free version of SSH, bringing

it up to date in terms of security and features.

This package includes the core files necessary for both the OpenSSH

client and server. To make this package useful, you should also

install openssh-clients, openssh-server, or both.

Update Information:

CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys CVE-2026-35414: Fix mishandling of authorized_keys principals option CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline

Topics%20covered

Topics Covered

security advisory fedora privilege escalation important information disclosure openssh

Change Log

* Fri Apr 17 2026 Zoltan Fridrich - 10.2p1-8 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: rhbz#2454941 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: rhbz#2454951 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: rhbz#2454944 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: rhbz#2454943 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: rhbz#2454961

References


[ 1 ] Bug #2454941 - CVE-2026-35385 openssh: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2454941 [ 2 ] Bug #2454943 - CVE-2026-35414 openssh: OpenSSH: Security bypass via mishandling of authorized_keys principals option [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2454943 [ 3 ] Bug #2454944 - CVE-2026-35387 openssh: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2454944 [ 4 ] Bug #2454951 - CVE-2026-35388 openssh: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2454951 [ 5 ] Bug #2454961 - CVE-2026-35386 openssh: OpenSSH: Arbitrary command execution via shell metacharacters in username [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=...

Read the Full Advisory

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-93679cc7c2' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
important
Lowest
Low
Medium
High
Critical

Name: openssh
Product: Fedora 44
Version: 10.2p1
Release: 8.fc44
URL: http://www.openssh.com/portable.html
Summary: An open source implementation of SSH protocol version 2

Topics%20covered

Topics Covered

security advisory fedora privilege escalation important information disclosure openssh

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here