[USN-8721-1] OpenSSH vulnerabilities

[noreply+usn-bot at canonical.com]

==========================================================================
Ubuntu Security Notice USN-8721-1
September 03, 2026

openssh vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in OpenSSH.

Software Description:
- openssh: secure shell (SSH) for secure access to remote machines

Details:

It was discovered that OpenSSH's ssh-agent incorrectly handled interactions
between agent locking and the session-bind at openssh.com extension. A remote
attacker with access to a forwarded agent connection could possibly use
this issue to perform operations that should only be available locally,
such as adding tokens or using keys. (CVE-2026-73281)

It was discovered that OpenSSH's ssh client incorrectly handled concurrent
remote-forwarding operations. A remote attacker could possibly use this
issue to cause a use-after-free condition, resulting in a denial of service
or the execution of arbitrary code. (CVE-2026-73282)

It was discovered that OpenSSH's sshd server incorrectly applied the
restrict keyword from authorized_keys to tunnel forwarding requests. A
local attacker with an authorized key could possibly use this issue to
bypass intended tunnel forwarding restrictions. (CVE-2026-73283)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  openssh-client                  1:10.2p1-2ubuntu3.6
  openssh-server                  1:10.2p1-2ubuntu3.6

Ubuntu 24.04 LTS
  openssh-client                  1:9.6p1-3ubuntu13.19
  openssh-server                  1:9.6p1-3ubuntu13.19

Ubuntu 22.04 LTS
  openssh-client                  1:8.9p1-3ubuntu0.17
  openssh-server                  1:8.9p1-3ubuntu0.17

After a standard system update you need to restart OpenSSH to make all the
necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8721-1
  CVE-2026-73281, CVE-2026-73282, CVE-2026-73283

Package Information:
  https://launchpad.net/ubuntu/+source/openssh/1:10.2p1-2ubuntu3.6
  https://launchpad.net/ubuntu/+source/openssh/1:9.6p1-3ubuntu13.19
  https://launchpad.net/ubuntu/+source/openssh/1:8.9p1-3ubuntu0.17
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20260903/ff8a5a1d/attachment.sig>