FEDORA-2026-a7570524a7 — security update for opkssh

stable

opkssh-0.15.0-2.fc44

FEDORA-2026-a7570524a7 created by thofmann 3 months ago for Fedora 44

Update to opkssh 0.15.0.

This release fixes several CVEs in bundled/vendored dependencies:

CVE-2026-39829: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
CVE-2026-39835: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
CVE-2026-39833: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
CVE-2026-27145: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (fixed via the Go toolchain used to build this package)

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2026-a7570524a7

This update has been submitted for testing by thofmann.

3 months ago

This update's test gating status has been changed to 'ignored'.

3 months ago

This update has been pushed to testing.

3 months ago

geraldosimiao provided feedback 3 months ago

karma

BZ#2492509 opkssh-0.15.0 is available

This update can be pushed to stable now if the maintainer wishes

3 months ago

This update has been submitted for stable by thofmann.

3 months ago

This update has been pushed to stable.

3 months ago

Please log in to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

disabled

Stable by Time

disabled

Dates

submitted

3 months ago

in testing

3 months ago

in stable

3 months ago

approved

3 months ago

Builds

opkssh-0.15.0-2.fc44

BZ#2490078 CVE-2026-39829 opkssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters [fedora-all]

BZ#2492509 opkssh-0.15.0 is available

BZ#2493536 CVE-2026-39835 opkssh: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate [fedora-all]

BZ#2494282 CVE-2026-27145 opkssh: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries [fedora-all]

BZ#2494472 CVE-2026-39833 opkssh: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation [fedora-all]

opkssh-0.15.0-2.fc44

Automated Test Results

ignored