-
Thu May 21 2026 Ilya Okomin <ilya.okomin@oracle.com> - 9.9p1-7.0.2
- Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM/NIST backport [Orabug: 39423076]
-
Fri Apr 17 2026 EL Errata <el-errata_ww@oracle.com> - 9.9p1-7.0.1
- Upstream references found with /usr/bin/ssh [Orabug: 37814929]
-
Thu Mar 26 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-7 + 0.10.4-9
- Version bump
-
Mon Mar 16 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-5 + 0.10.4-8
- CVE-2026-3497: Fix information disclosure or denial of service due
to uninitialized variables in gssapi-keyex
Resolves: RHEL-155825
- Fix incorrect claim about SSH_AUTH_SOCK in pam_ssh_agent_auth manual page
Resolves: RHEL-122302
-
Wed Feb 25 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-4
- Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode
Resolves: RHEL-151580
-
Tue Dec 09 2025 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-3
- Enable support for DSA keys
Resolves: RHEL-127624
- CVE-2025-61984: Reject usernames with control characters
Resolves: RHEL-133959
- CVE-2025-61985: Reject URL-strings with NULL characters
Resolves: RHEL-133960
-
Mon Oct 27 2025 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-2
- Fix implicit destination path selection when source path ends with ".."
Resolves: RHEL-119515
- Canonicalize username when matching a user
Resolves: RHEL-118372
-
Wed Sep 10 2025 Pavol Žáčik <pzacik@redhat.com> - 9.9p1-1
- Rebase to version 9.9
Resolves: RHEL-108912
-
Mon Jul 21 2025 Zoltan Fridrich <zfridric@redhat.com> - 8.7p1-46
- Move the redhat help message to debug1 log level
Resolves: RHEL-104580
-
Tue Feb 18 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-45
- Fix missing error codes set and invalid error code checks in OpenSSH. It
prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS
is on (CVE-2025-26465).
Resolves: RHEL-78700