Alerts This Week
Warning Icon 1 1,394
Alerts This Week
Warning Icon 1 1,394

SUSE: 2025:0744-1 moderate: openssh8.4 Man-in-the-Middle Fix

suse
Calendar Grey February 28, 2025
Dist Suse Esm H88
SUSE has issued a Security Update for OpenSSH 8.4 addressing a moderate-risk vulnerability. Users should swiftly apply this update to enhance security and avoid potential exploits.
* bsc#1186673 * bsc#1213004 * bsc#1213008 * bsc#1214788 * bsc#1216474

Summary

## This update for openssh8.4 fixes the following issues: * CVE-2025-26465: Fixed a MitM attack against OpenSSH's VerifyHostKeyDNS- enabled client (bsc#1237040). Other bugfixes: * Fix usage of local accelerator cards via openssl-ibmca (bsc#1216474, bsc#1218871). * Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled) (bsc#1222831). * Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123). * For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure (bsc#1214788). * Attempts to mitigate instances of secrets lingering in memory after a session exits (bsc#1213004, bsc#1213008, bsc#1186673). ## Patch Instructions:

Topics%20covered

Topics Covered

security advisory moderate update instructions openssh SUSE Linux SUSE Linux Enterprise MitM attack MitM

References

* bsc#1186673

* bsc#1213004

* bsc#1213008

* bsc#1214788

* bsc#1216474

* bsc#1218871

* bsc#1221123

* bsc#1222831

* bsc#1237040

Cross-

* CVE-2025-26465

CVSS scores:

* CVE-2025-26465 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

* CVE-2025-26465 ( NVD ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected Products:

* SUSE Linux Enterprise High Performance Computing 12 SP5

* SUSE Linux Enterprise Server 12 SP5

* SUSE Linux Enterprise Server 12 SP5 LTSS

* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security

* SUSE Linux Enterprise Server for SAP Applications 12 SP5

An update that solves one vulnerability and has eight security fixes can now be

installed.

##

* https://www.suse.com/security/cve/CVE-2025-26465.html

* https://bugzilla.suse.com/show_bug.cgi?id=1186673

Announcement ID: SUSE-SU-2025:0744-1
Release Date: 2025-02-28T14:39:39Z
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate update instructions openssh SUSE Linux SUSE Linux Enterprise MitM attack MitM

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here