FEDORA-2026-387cf555e7 — security update for opkssh

stable

opkssh-0.15.0-2.fc43

FEDORA-2026-387cf555e7 created by thofmann a month ago for Fedora 43

Update to opkssh 0.15.0.

This release fixes several CVEs in bundled/vendored dependencies:

CVE-2026-39829: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
CVE-2026-39835: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
CVE-2026-39833: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
CVE-2026-27145: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (fixed via the Go toolchain used to build this package)

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2026-387cf555e7

This update has been submitted for testing by thofmann.

a month ago

This update's test gating status has been changed to 'ignored'.

a month ago

This update has been pushed to testing.

a month ago

geraldosimiao provided feedback a month ago

karma

BZ#2492509 opkssh-0.15.0 is available

This update can be pushed to stable now if the maintainer wishes

a month ago

This update has been submitted for stable by thofmann.

4 weeks ago

This update has been pushed to stable.

4 weeks ago

Please log in to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

disabled

Stable by Time

disabled

Dates

submitted

a month ago

in testing

a month ago

in stable

4 weeks ago

approved

a month ago

Builds

opkssh-0.15.0-2.fc43

BZ#2490078 CVE-2026-39829 opkssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters [fedora-all]

BZ#2492509 opkssh-0.15.0 is available

BZ#2493536 CVE-2026-39835 opkssh: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate [fedora-all]

BZ#2494282 CVE-2026-27145 opkssh: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries [fedora-all]

BZ#2494472 CVE-2026-39833 opkssh: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation [fedora-all]

opkssh-0.15.0-2.fc43

Automated Test Results

ignored