SUSE-SU-2026:4622-1: important: Security update for apache-sshd
SLE-SECURITY-UPDATES
null at suse.de
Mon Oct 12 12:31:14 UTC 2026
# Security update for apache-sshd
Announcement ID: SUSE-SU-2026:4622-1
Release Date: 2026-10-12T07:25:51Z
Rating: important
References:
* bsc#1283344
* bsc#1283345
* bsc#1283346
* bsc#1283347
* bsc#1283348
* bsc#1283350
* bsc#1283352
* bsc#1283357
Cross-References:
* CVE-2026-77185
* CVE-2026-93994
* CVE-2026-93995
* CVE-2026-93996
* CVE-2026-94002
* CVE-2026-94029
* CVE-2026-94052
* CVE-2026-94053
CVSS scores:
* CVE-2026-77185 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-77185 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-93994 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-93994 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-93995 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-93995 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-93996 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-93996 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-94002 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-94002 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-94029 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-94029 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-94052 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-94052 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-94053 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-94053 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products:
* Development Tools Module 15-SP7
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP4 LTSS
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP5 LTSS
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP6 LTSS
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
An update that solves eight vulnerabilities can now be installed.
## Description:
This update for apache-sshd fixes the following issues:
* CVE-2026-77185: Asynchronous authentication can bypass signature
verification (bsc#1283357).
* CVE-2026-93994: Repeated-publickey policy bypass on server (bsc#1283352).
* CVE-2026-93995: Remote execution of JGit "archive -o=file.zip" can write
file on the server (bsc#1283350).
* CVE-2026-93996: Memory exhaustion DoS via unbounded SCP command line read
(bsc#1283348).
* CVE-2026-94002: Memory exhaustion in SFTP client via unsolicited SFTP
replies (bsc#1283347).
* CVE-2026-94029: Memory exhaustion in SFTP v6 check-file-name/check-file-
handle extension (bsc#1283346).
* CVE-2026-94052: LDAP password authentication ineffective (bsc#1283345).
* CVE-2026-94053: LDAP injection in sshd-ldap (bsc#1283344).
Changes for apache-sshd:
* Update to upstream version 2.20.0:
* GH-656 ChannelPipedInputStream: shrink buffer when emptied
* GH-906 Fix finding a signature factory for BC ed25519 keys
* GH-911 Fix server-side SOCKS5 proxy for fragmented and pipelined CONNECT
requests
* Allow asynchronous authentication only for password and keyboard-interactive
authentication schemes
* Fix authentication requiring multiple public keys (server-side)
* Better argument handling in sshd-git
* More checks in authentication (server-side)
* Better SCP command handling
* SFTP client: simplify response message handling
* Fix check-file-name/check-file-handle SFTP v6 extension
* Improve LDAP authentication (sshd-ldap)
* New Features
* GH-905 Implement the "from" and "expiry-time" options in authorized_keys
handling in public key authentication (server side)
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-4622
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-4622
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-4622
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-4622
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-4622
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-4622
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-4622
* SUSE Linux Enterprise Server 15 SP4 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-4622
* Development Tools Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP7-2026-4622
* SUSE Linux Enterprise Server 15 SP5 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-4622
* SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-4622
## Package List:
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch)
* apache-sshd-2.20.0-150200.5.19.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch)
* apache-sshd-2.20.0-150200.5.19.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch)
* apache-sshd-2.20.0-150200.5.19.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch)
* apache-sshd-2.20.0-150200.5.19.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch)
* apache-sshd-2.20.0-150200.5.19.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch)
* apache-sshd-2.20.0-150200.5.19.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
* apache-sshd-2.20.0-150200.5.19.1
* SUSE Linux Enterprise Server 15 SP4 LTSS (noarch)
* apache-sshd-2.20.0-150200.5.19.1
* Development Tools Module 15-SP7 (noarch)
* apache-sshd-2.20.0-150200.5.19.1
* SUSE Linux Enterprise Server 15 SP5 LTSS (noarch)
* apache-sshd-2.20.0-150200.5.19.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
* apache-sshd-2.20.0-150200.5.19.1
## References:
* https://www.suse.com/security/cve/CVE-2026-77185.html
* https://www.suse.com/security/cve/CVE-2026-93994.html
* https://www.suse.com/security/cve/CVE-2026-93995.html
* https://www.suse.com/security/cve/CVE-2026-93996.html
* https://www.suse.com/security/cve/CVE-2026-94002.html
* https://www.suse.com/security/cve/CVE-2026-94029.html
* https://www.suse.com/security/cve/CVE-2026-94052.html
* https://www.suse.com/security/cve/CVE-2026-94053.html
* https://bugzilla.suse.com/show_bug.cgi?id=1283344
* https://bugzilla.suse.com/show_bug.cgi?id=1283345
* https://bugzilla.suse.com/show_bug.cgi?id=1283346
* https://bugzilla.suse.com/show_bug.cgi?id=1283347
* https://bugzilla.suse.com/show_bug.cgi?id=1283348
* https://bugzilla.suse.com/show_bug.cgi?id=1283350
* https://bugzilla.suse.com/show_bug.cgi?id=1283352
* https://bugzilla.suse.com/show_bug.cgi?id=1283357
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261012/ecccaa2c/attachment.htm>
More information about the sle-security-updates
mailing list