This is an automated archive made by the Lemmit Bot.
The original was posted on /r/opensource by /u/deron666 on 2025-02-19 14:03:59+00:00.
The Qualys Threat Research Unit (TRU) has disclosed two critical vulnerabilities in OpenSSH—CVE-2025-26465 and CVE-2025-26466 — affecting both the client and server components.
The first allows machine-in-the-middle (MitM) attacks against the OpenSSH client when the VerifyHostKeyDNS option is enabled. The second enables an asymmetric denial-of-service (DoS) attack that consumes both memory and CPU, affecting both clients and servers. These flaws have left millions of systems vulnerable for years, with one issue dating back to December 2014.
Flaws in OpenSSH
OpenSSH is a widely adopted open-source implementation of the Secure Shell (SSH) protocol, providing encrypted remote access, file transfers, and tunneling across Linux, macOS, BSD, and Windows environments. Its security is paramount, as it replaces insecure protocols like Telnet and FTP. OpenSSH is integral to cloud infrastructure, enterprise IT, and DevOps automation, making any security flaw in it a major concern.