RHSA-2026:82247MediumCVSS 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
October 13, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (11)

CVE-2026-106552 →CVE-2026-106583 →CVE-2026-106584 →CVE-2026-106585 →CVE-2026-106587 →CVE-2026-110925 →CVE-2026-110926 →CVE-2026-110927 →CVE-2026-106582 →CVE-2026-106586 →CVE-2026-110923 →

📋 Description

CVE-2026-106552 — openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy CVE-2026-106582 — openssh: openssh: Information disclosure via shared compression side-channel CVE-2026-106583 — openssh: openssh: Command injection via unvalidated command-line username CVE-2026-106584 — openssh: openssh: Incorrect certificate expiration times via Daylight Saving Time mishandling CVE-2026-106585 — openssh: openssh: Denial of service via oversized decompressed packets CVE-2026-106586 — openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding CVE-2026-106587 — openssh: OpenSSH: Improper access control via misinterpretation of disabled configuration options CVE-2026-110923 — openssh: openssh: sftp can write outside the destination directory from a server-supplied path CVE-2026-110925 — openssh: openssh: '$' and '' in a command-line username expand through %u CVE-2026-110926 — openssh: openssh: shared LZ77 compression dictionary leaks plaintext across channels CVE-2026-110927 — openssh: openssh: a compressed payload can expand past the maximum packet size

🎯 Affected products23

  • Red Hat Hardened Images
  • openssh-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-0:10.5p1-1.2.hum1@src as a component of Red Hat Hardened Images
  • openssh-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-askpass-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-askpass-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-askpass-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-clients-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-clients-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-clients-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-keycat-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-keycat-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-keycat-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-keysign-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-keysign-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-keysign-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-server-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-server-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-server-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images
  • openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Session compression is not enabled by default in OpenSSH; keeping it disabled prevents this side-channel. Set 'Compression no' in sshd_config on servers and in ssh_config (or use 'ssh -o Compression=no') on clients where compression has been enabled. Avoid multiplexing trusted and untrusted traffic over a single shared SSH connection, for example via ssh connection multiplexing (ControlMaster). Where compression of transferred data is required, applying compression at the application level before data enters the SSH session is not affected by this type of attack. A fix is being pursued for the affected Red Hat Hardened Images product. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users of the affected openssh packages in Red Hat Hardened Images should install the updated packages provided through their product's update channels. Workaround: This flaw only affects servers where tunnel forwarding has been explicitly enabled; PermitTunnel is disabled by default in OpenSSH sshd. As a workaround, tunnel forwarding can be disabled by setting "PermitTunnel no" in /etc/ssh/sshd_config (or removing any configuration that enables it) and restarting the sshd service, which prevents restricted keys from establishing network tunnels. This flaw can also be resolved by updating to the corrected openssh packages available through the affected Red Hat Hardened Images update stream. Workaround: As a workaround, avoid setting options that accept the value "none" (for example AuthorizedPrincipalsFile) inside sshd_config Match blocks, where sshd misinterprets the value as a literal file path. Instead, apply the "none" value at the global configuration level outside of Match blocks, where it correctly disables the feature, or restructure the configuration so that these options are not set to "none" via a Match keyword. This prevents sshd from reading a file named "none" that may be controlled by a local user. Alternatively, updating to a version of OpenSSH that includes the upstream fix resolves the issue.

🔗 References (15)