ELSA-2026-69129

ELSA-2026-69129 - openssh security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-09-29

Description

[9.9p1-27.0.1]
- Upstream references found with /usr/bin/ssh [Orabug: 37824421]

[9.9p1-27]
- CVE-2026-73283: Complete the fix of security bypass due to incorrect
handling of forwarding and tunneling options
Resolves: RHEL-245413
- CVE-2026-73281: Fix misinteraction between agent locking and
the session-bind@openssh.com extension
Resolves: RHEL-245423
- CVE-2026-73282: Fix information disclosure and data corruption
via use-after-free in ssh client
Resolves: RHEL-245418

[9.9p1-26]
- Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded
file location
Resolves: RHEL-236314
- Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect
handling of forwarding and tunneling options
Resolves: RHEL-236288

Related CVEs

CVE-2026-59995

CVE-2026-59999

CVE-2026-73281

CVE-2026-73282

CVE-2026-73283

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	openssh-9.9p1-27.0.1.el10_2.src.rpm	2e184cdb4e105c19404289516777ddb738a5d71aee59dca5252b91b013d3ec29	-	ol10_aarch64_appstream
	openssh-9.9p1-27.0.1.el10_2.src.rpm	2e184cdb4e105c19404289516777ddb738a5d71aee59dca5252b91b013d3ec29	-	ol10_aarch64_baseos_latest
	openssh-9.9p1-27.0.1.el10_2.src.rpm	2e184cdb4e105c19404289516777ddb738a5d71aee59dca5252b91b013d3ec29	-	ol10_aarch64_u2_baseos_patch
	openssh-9.9p1-27.0.1.el10_2.aarch64.rpm	008185f8b223313ebfbf7fbcb3d982d4706e4a99c539e6f766e71646b47ab927	-	ol10_aarch64_baseos_latest
	openssh-9.9p1-27.0.1.el10_2.aarch64.rpm	008185f8b223313ebfbf7fbcb3d982d4706e4a99c539e6f766e71646b47ab927	-	ol10_aarch64_u2_baseos_patch
	openssh-askpass-9.9p1-27.0.1.el10_2.aarch64.rpm	1b130234236369412aaaefa169a8a18ac73f5c155fb51e3b9b900b80cee6d014	-	ol10_aarch64_appstream
	openssh-clients-9.9p1-27.0.1.el10_2.aarch64.rpm	b1371dbe0cb1773b6eaad86117b326c3028741eebc7b8822ef58668421991f4c	-	ol10_aarch64_baseos_latest
	openssh-clients-9.9p1-27.0.1.el10_2.aarch64.rpm	b1371dbe0cb1773b6eaad86117b326c3028741eebc7b8822ef58668421991f4c	-	ol10_aarch64_u2_baseos_patch
	openssh-keycat-9.9p1-27.0.1.el10_2.aarch64.rpm	218f1593ec73655a49a164f2b7e5f04ef35d48a301d962559dbb39f4c07ec857	-	ol10_aarch64_baseos_latest
	openssh-keycat-9.9p1-27.0.1.el10_2.aarch64.rpm	218f1593ec73655a49a164f2b7e5f04ef35d48a301d962559dbb39f4c07ec857	-	ol10_aarch64_u2_baseos_patch
	openssh-keysign-9.9p1-27.0.1.el10_2.aarch64.rpm	d9e3f7b053fbd29da53f88351428fdf08ed90fc8dbd3cc55a32ccf09a53483c1	-	ol10_aarch64_appstream
	openssh-server-9.9p1-27.0.1.el10_2.aarch64.rpm	f7ed992f85518833a599770c96f2cecd004389eef811a8c8d6ae103dffb5d2b4	-	ol10_aarch64_baseos_latest
	openssh-server-9.9p1-27.0.1.el10_2.aarch64.rpm	f7ed992f85518833a599770c96f2cecd004389eef811a8c8d6ae103dffb5d2b4	-	ol10_aarch64_u2_baseos_patch
Oracle Linux 10 (x86_64)	openssh-9.9p1-27.0.1.el10_2.src.rpm	2e184cdb4e105c19404289516777ddb738a5d71aee59dca5252b91b013d3ec29	-	ol10_x86_64_appstream
	openssh-9.9p1-27.0.1.el10_2.src.rpm	2e184cdb4e105c19404289516777ddb738a5d71aee59dca5252b91b013d3ec29	-	ol10_x86_64_baseos_latest
	openssh-9.9p1-27.0.1.el10_2.src.rpm	2e184cdb4e105c19404289516777ddb738a5d71aee59dca5252b91b013d3ec29	-	ol10_x86_64_u2_baseos_patch
	openssh-9.9p1-27.0.1.el10_2.x86_64.rpm	1a85108f5319f6b5fc4c8c95f67fddb208808f73256b278bd9b1401b098470e0	-	ol10_x86_64_baseos_latest
	openssh-9.9p1-27.0.1.el10_2.x86_64.rpm	1a85108f5319f6b5fc4c8c95f67fddb208808f73256b278bd9b1401b098470e0	-	ol10_x86_64_u2_baseos_patch
	openssh-askpass-9.9p1-27.0.1.el10_2.x86_64.rpm	25cf32a9a50323be5409dad7998260d7961fb298d7f04d90e86cbcbedf8097d1	-	ol10_x86_64_appstream
	openssh-clients-9.9p1-27.0.1.el10_2.x86_64.rpm	3e11948b7763f7b5248218545ae21aedd2a1d03c298b7fed455abb3703ba15c5	-	ol10_x86_64_baseos_latest
	openssh-clients-9.9p1-27.0.1.el10_2.x86_64.rpm	3e11948b7763f7b5248218545ae21aedd2a1d03c298b7fed455abb3703ba15c5	-	ol10_x86_64_u2_baseos_patch
	openssh-keycat-9.9p1-27.0.1.el10_2.x86_64.rpm	12a261a00762941c21757e429e6489a3afcccdedf09fe65966e11611dce502cc	-	ol10_x86_64_baseos_latest
	openssh-keycat-9.9p1-27.0.1.el10_2.x86_64.rpm	12a261a00762941c21757e429e6489a3afcccdedf09fe65966e11611dce502cc	-	ol10_x86_64_u2_baseos_patch
	openssh-keysign-9.9p1-27.0.1.el10_2.x86_64.rpm	32f7477aaec13ca687ce08d122fab70f80e11fb553f126ebd516caf676f5912b	-	ol10_x86_64_appstream
	openssh-server-9.9p1-27.0.1.el10_2.x86_64.rpm	c22abfbc90866b9571d9318ac11d1a3c178a83840973a858a1779c0304d1fcd6	-	ol10_x86_64_baseos_latest
	openssh-server-9.9p1-27.0.1.el10_2.x86_64.rpm	c22abfbc90866b9571d9318ac11d1a3c178a83840973a858a1779c0304d1fcd6	-	ol10_x86_64_u2_baseos_patch

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team