OpenSSH : traversée de répertoires

1. Vérifier si vous êtes concerné

   Comparer la version installée aux versions corrigées ci-dessous.

   ssh -V
   sshd -V

2. Corriger

   Versions corrigées : openssh 1:10.5p1-1ubuntu3.1 (stonking), openssh 1:8.9p1-3ubuntu0.18 (jammy), openssh 1:9.6p1-3ubuntu13.20 (noble), openssh 1:10.2p1-2ubuntu3.8 (resolute).

   Mettre à jour OpenSSH et redémarrer le service sshd.

   sudo apt update && sudo apt install --only-upgrade openssh-server
   sudo systemctl restart ssh

3. En attendant le correctif

   Restreindre l'accès SSH par pare-feu aux adresses de l'agence et du VPN.

4. Contrôler

   ssh -V doit afficher la version corrigée.

Commandes indicatives (Debian ou Ubuntu) : à adapter à chaque serveur, après sauvegarde.

Several security issues were fixed in OpenSSH. It was discovered that OpenSSH's sftp client incorrectly handled paths returned by the server during a recursive copy operation. A remote attacker controlling the server could possibly use this issue to write files to unintended locations. (CVE-2026-106552) It was discovered that OpenSSH's sshd server incorrectly handled GSSAPIAuthentication state across authentication attempts. An attacker could possibly use this issue to obtain credentials from a previous failed authentication attempt. (CVE-2026-106553, CVE-2026-106555) It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder during compression. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-106582) It was discovered that OpenSSH's ssh client incorrectly allowed special characters in command-line usernames. An attacker could possibly use this issue to inject arbitrary commands via specially crafted usernames. (CVE-2026-106583) It was discovered that OpenSSH's ssh-keygen incorrectly handled Daylight Saving Time when converting dates. An attacker could possibly use this issue to cause certificates to have incorrect expiration times. (CVE-2026-106584) It was discovered that OpenSSH did not check whether the maximum packet length was exceeded during decompression. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-106585) It was discovered that OpenSSH's sshd server incorrectly applied the restrict keyword from authorized_keys to tunnel forwarding requests. A local attacker with an authorized key could possibly use this issue to bypass intended tunnel forwarding restrictions. (CVE-2026-106586) It was discovered that OpenSSH's sshd server incorrectly handled certain configuration options that accept a "none" value. An attacker could possibly use this issue to cause OpenSSH to behave unexpectedly. (CVE-2026-106587)