RHSA-2026:5475HighCVSS 8.2

Red Hat Security Advisory: Red Hat Hardened Images RPM Release

Published
March 23, 2026
Last Modified
August 3, 2026

🔗 CVE IDs covered (3)

CVE-2025-61984 →CVE-2025-61985 →CVE-2026-3497 →

📋 Description

CVE-2025-61984 — openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand CVE-2025-61985 — openssh: OpenSSH: Null character in ssh:// URI can lead to code execution via ProxyCommand CVE-2026-3497 — openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables

🎯 Affected products4

  • Red Hat Hardened Images
  • openssh-main@aarch64 as a component of Red Hat Hardened Images
  • openssh-main@src as a component of Red Hat Hardened Images
  • openssh-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

Red Hat Hardened Images RPM Release Workaround: To mitigate this issue, disable GSSAPI key exchange in the OpenSSH server configuration. This prevents the server from processing GSSAPI messages, eliminating the vulnerability's attack surface. Edit `/etc/ssh/sshd_config` and add or modify the line: ``` GSSAPIKeyExchange no ``` After saving the changes, restart the `sshd` service for the mitigation to take effect. This action will prevent users from authenticating via GSSAPI. ``` # systemctl restart sshd ```

🔗 References (6)