CVE-2025-26465

Publication date 18 February 2025

Last updated 19 February 2025

Ubuntu priority

Medium

Why this priority?

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

Read the notes from the security team

Status

Package Ubuntu Release Status
openssh 24.10 oracular
Fixed 1:9.7p1-7ubuntu4.2
24.04 LTS noble
Fixed 1:9.6p1-3ubuntu13.8
22.04 LTS jammy
Fixed 1:8.9p1-3ubuntu0.11
20.04 LTS focal
Fixed 1:8.2p1-4ubuntu0.12
18.04 LTS bionic
16.04 LTS xenial
openssh-ssh1 24.10 oracular Ignored
24.04 LTS noble Ignored
22.04 LTS jammy Ignored
20.04 LTS focal Ignored
18.04 LTS bionic Ignored

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro

Notes

mdeslaur

openssh-ssh1 is only provided for compatibility with old devices that cannot be upgraded to modern protocols. We will not be providing any security support for the openssh-ssh1 package as it is insecure and should be used in trusted environments only. introduced in 6.8p1

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
openssh

References

Related Ubuntu Security Notices (USN)

    • USN-7270-1
    • OpenSSH vulnerabilities
    • 18 February 2025
    • USN-7270-2
    • OpenSSH vulnerability
    • 18 February 2025

Other references