Amazon Linux 2023 Security Advisory: ALAS2023-2026-1441
Advisory Released Date: 2026-02-18
Advisory Updated Date: 2026-02-18
Severity:
Low
Issue Overview:
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.) (CVE-2025-61984)
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used. (CVE-2025-61985)
Affected Packages:
openssh
Issue Correction:
Run dnf update openssh --releasever 2023.10.20260216 or dnf update --advisory ALAS2023-2026-1441 --releasever 2023.10.20260216 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
openssh-debuginfo-8.7p1-8.amzn2023.0.16.aarch64
openssh-clients-debuginfo-8.7p1-8.amzn2023.0.16.aarch64
openssh-keycat-8.7p1-8.amzn2023.0.16.aarch64
openssh-server-debuginfo-8.7p1-8.amzn2023.0.16.aarch64
openssh-debugsource-8.7p1-8.amzn2023.0.16.aarch64
openssh-8.7p1-8.amzn2023.0.16.aarch64
pam_ssh_agent_auth-debuginfo-0.10.4-4.8.amzn2023.0.16.aarch64
openssh-keycat-debuginfo-8.7p1-8.amzn2023.0.16.aarch64
pam_ssh_agent_auth-0.10.4-4.8.amzn2023.0.16.aarch64
openssh-server-8.7p1-8.amzn2023.0.16.aarch64
openssh-clients-8.7p1-8.amzn2023.0.16.aarch64
src:
openssh-8.7p1-8.amzn2023.0.16.src
x86_64:
openssh-keycat-debuginfo-8.7p1-8.amzn2023.0.16.x86_64
openssh-clients-debuginfo-8.7p1-8.amzn2023.0.16.x86_64
openssh-server-debuginfo-8.7p1-8.amzn2023.0.16.x86_64
pam_ssh_agent_auth-0.10.4-4.8.amzn2023.0.16.x86_64
openssh-keycat-8.7p1-8.amzn2023.0.16.x86_64
pam_ssh_agent_auth-debuginfo-0.10.4-4.8.amzn2023.0.16.x86_64
openssh-debuginfo-8.7p1-8.amzn2023.0.16.x86_64
openssh-server-8.7p1-8.amzn2023.0.16.x86_64
openssh-8.7p1-8.amzn2023.0.16.x86_64
openssh-clients-8.7p1-8.amzn2023.0.16.x86_64
openssh-debugsource-8.7p1-8.amzn2023.0.16.x86_64