Bug 2447085 (CVE-2026-3497)
| Summary: | CVE-2026-3497 openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | alcohan, gparvin, jbalunas, kshier, mario.held, pahickey, rhaigner, rhel-process-autobot, stcannon, teagle, watson-tool-maintainers, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the OpenSSH GSSAPI (Generic Security Service Application Program Interface) delta patches, as included in various Linux distributions. A remote attacker could exploit this by sending an unexpected GSSAPI message type during the key exchange process. This occurs because the `sshpkt_disconnect()` function, when called on an error, does not properly terminate the process, leading to the continued execution of the program with uninitialized connection variables. Accessing these uninitialized variables can lead to undefined behavior, potentially resulting in information disclosure or a denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2447289, 2447290 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-03-12 19:02:00 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:6463 https://access.redhat.com/errata/RHSA-2026:6463 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:6461 https://access.redhat.com/errata/RHSA-2026:6461 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:6462 https://access.redhat.com/errata/RHSA-2026:6462 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:7107 https://access.redhat.com/errata/RHSA-2026:7107 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:9415 https://access.redhat.com/errata/RHSA-2026:9415 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2026:9732 https://access.redhat.com/errata/RHSA-2026:9732 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:10714 https://access.redhat.com/errata/RHSA-2026:10714 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2026:13750 https://access.redhat.com/errata/RHSA-2026:13750 This issue has been addressed in the following products: RHEL-8 based Middleware Containers Via RHSA-2026:13812 https://access.redhat.com/errata/RHSA-2026:13812 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:14924 https://access.redhat.com/errata/RHSA-2026:14924 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:15891 https://access.redhat.com/errata/RHSA-2026:15891 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2026:15893 https://access.redhat.com/errata/RHSA-2026:15893 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2026:12071 https://access.redhat.com/errata/RHSA-2026:12071 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2026:15087 https://access.redhat.com/errata/RHSA-2026:15087 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2026:14773 https://access.redhat.com/errata/RHSA-2026:14773 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2026:17596 https://access.redhat.com/errata/RHSA-2026:17596 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.19 Via RHSA-2026:20040 https://access.redhat.com/errata/RHSA-2026:20040 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2026:20087 https://access.redhat.com/errata/RHSA-2026:20087 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2026:21690 https://access.redhat.com/errata/RHSA-2026:21690 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2026:21695 https://access.redhat.com/errata/RHSA-2026:21695 |