gpp_maybe
Security update for apache-sshd
SUSE-SLE-Module-Development-Tools-15-SP7-2026-3339
This update for apache-sshd fixes the following issues: Update to upstream version 2.19.0. Security issues fixed: - CVE-2026-56452: remote users can use SCP to send filenames that lead to arbitrary file writes due to a path traversal issue in the `sshd-scp` component of Apache MINA SSHD. (bsc#1272158). - CVE-2026-56623: remote users can obtain access to git repositories outside of the configured server-side root directory on Windows systems due to path traversal issue in `org.apache.sshd:sshd-git` (bsc#1271993). - CVE-2026-56624: users can authenticate with certificates containing the `force-command` option but still execute other commands due to improper validation of certificate options in Apache MINA SSHD (bsc#1271992). - CVE-2026-58624: remote execution of JGit commands can lead to arbitrary file writes due to improper input validation in `sshd-git` of Apache MINA SSHD (bsc#1271991). Other updates and bugfixes: - Version 2.19.0: * Bug Fixes + GH-899 Fix ProcessShellFactory on Linux. + GH-902 Fix client-side handling of sk-* public key signatures (also in the agent interfaces). + Limit size of decompressed SSH packets. + Improve checking SSH user certificates in public-key authentication. + Improve handling of repository paths in sshd-git on Windows. + Validate file names in SCP. + Escape newlines in filenames in the SCP protocol. + Restrict JGit commands accessible via GitPgmCommandFactory in sshd-git.
-
Release DateJul 28 2026
-
ReferencesBugzilla: 1271991, 1271992, 1271993, 1272158
CVEs: CVE-2026-56452, CVE-2026-56623, CVE-2026-56624, CVE-2026-58624 -
Typesecurity
-
Severityimportant
cloud_download Downloads
Development Tools Module 15.7 ppc64le
-
Packages
Development Tools Module 15.7 s390x
-
Packages
Development Tools Module 15.7 aarch64
-
Packages
Development Tools Module 15.7 x86_64
-
Packages