Ubuntu 22.04 OpenSSH Important Remote Access Issues USN-8222-1

ubuntu

April 29, 2026

Several security issues were fixed in OpenSSH.

Summary

Several security issues were fixed in OpenSSH.

Software Description:

- openssh: secure shell (SSH) for secure access to remote machines

Details:

Christos Papakonstantinou discovered that the OpenSSH scp tool incorrectly

handled the legacy scp protocol (-O) option. This could result in certain

files being installed setuid or setgid, contrary to expectations.

(CVE-2026-35385)

Florian Kohnh�user discovered that OpenSSH incorrectly handled shell

metacharacters in usernames within a command line. When untrusted usernames

and non-default configurations using % in ssh_config are being used, an

attacker could possibly use this issue to execute arbitrary code.

(CVE-2026-35386)

Christos Papakonstantinou discovered that OpenSSH incorrectly handled

parsing the PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms

options. This could result in unintended ECDSA algorithms being used,

contrary to expectations. (CVE-2026-35387)

Michalis Vasileiadis discovered that OpenSSH incorrectly ha...

Read the Full Advisory

Topics Covered

security advisory remote access Ubuntu important arbitrary code openssh

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  openssh-client                  1:10.2p1-2ubuntu3.2
  openssh-server                  1:10.2p1-2ubuntu3.2

Ubuntu 25.10
  openssh-client                  1:10.0p1-5ubuntu5.4
  openssh-server                  1:10.0p1-5ubuntu5.4

Ubuntu 24.04 LTS
  openssh-client                  1:9.6p1-3ubuntu13.16
  openssh-server                  1:9.6p1-3ubuntu13.16

Ubuntu 22.04 LTS
  openssh-client                  1:8.9p1-3ubuntu0.15
  openssh-server                  1:8.9p1-3ubuntu0.15

In general, a standard system update will make all the necessary changes.