RHSA-2025:6993MediumCVSS 6.8

Red Hat Security Advisory: openssh security update

Published
May 13, 2025
Last Modified
October 21, 2026

🔗 CVE IDs covered (2)

CVE-2025-26466 →CVE-2025-26465 →

📋 Description

CVE-2025-26465 — openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabled CVE-2025-26466 — openssh: Denial-of-service in OpenSSH

🎯 Affected products91

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-0:8.7p1-45.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-0:8.7p1-45.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-0:8.7p1-45.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-0:8.7p1-45.el9.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-0:8.7p1-45.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-askpass-0:8.7p1-45.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-askpass-0:8.7p1-45.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-askpass-0:8.7p1-45.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-askpass-0:8.7p1-45.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-askpass-debuginfo-0:8.7p1-45.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-askpass-debuginfo-0:8.7p1-45.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-askpass-debuginfo-0:8.7p1-45.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-askpass-debuginfo-0:8.7p1-45.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-askpass-debuginfo-0:8.7p1-45.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-askpass-debuginfo-0:8.7p1-45.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-askpass-debuginfo-0:8.7p1-45.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-askpass-debuginfo-0:8.7p1-45.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-clients-0:8.7p1-45.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-clients-0:8.7p1-45.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-clients-0:8.7p1-45.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-clients-0:8.7p1-45.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-clients-debuginfo-0:8.7p1-45.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-clients-debuginfo-0:8.7p1-45.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-clients-debuginfo-0:8.7p1-45.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-clients-debuginfo-0:8.7p1-45.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-clients-debuginfo-0:8.7p1-45.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • openssh-clients-debuginfo-0:8.7p1-45.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • openssh-clients-debuginfo-0:8.7p1-45.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +61 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: This issue can be mitigated by disabling VerifyHostKeyDNS by setting that option to 'no' in an SSH client configuration file (such as /etc/ssh/ssh_config, ~/.ssh/config, or one of the files in the /etc/ssh/ssh_config.d/ directory). This is the default configuration in Red Hat Enterprise Linux. For configurations that require VerifyHostKeyDNS to be enabled (set to either 'yes' or 'ask'), mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: This issue can be mitigated by setting the following three different options in the sshd configuration file located at: /etc/ssh/sshd_config MaxStartups: Set to a reasonable value, this option controls the maximum number of concurrent unauthenticated connections the SSH server accepts; PerSourcePenalties: Set its suboptions to a reasonable value, this option is used to help sshd to detect and drop connections that are potentially malicious for the SSH server; LoginGraceTime: Set to a resonable value, this option controls how much time the SSH server will wait the client to authenticate before dropping its connection; All the three option above needs to be set to implement a full mitigation for this vulnerability.

🔗 References (7)