Release date:
2026-05-05 10:28:42 UTC
Description:
- CVE-2026-35385: when downloading files as root in legacy (-O) mode and
without the -p (preserve modes) flag, scp(1) did not clear setuid/setgid
bits from downloaded files. Backport upstream commit 487e8ac1 to mask
out the setuid/setgid bits in this case.
Updated packages:
-
openssh-8.0p1-10.el8.tuxcare.els11.x86_64.rpm
sha:19a639f53935e02570c7f698278e45a388ab66f71facaa5bd1ccb5dc0be35f18
-
openssh-askpass-8.0p1-10.el8.tuxcare.els11.x86_64.rpm
sha:a0a3ff6d6f5da9402b82e7c65d0240c1663ecd1eab833ae998f362acbaf056d2
-
openssh-cavs-8.0p1-10.el8.tuxcare.els11.x86_64.rpm
sha:d5cd9dc797ab5d15afb80bef94a82935f3cfb3b768a5ed9f88f11a262a7f4f9e
-
openssh-clients-8.0p1-10.el8.tuxcare.els11.x86_64.rpm
sha:6836abd57541578db7e7a659334255ac1bc28d51642ac00a4a777f1457c1a0e4
-
openssh-keycat-8.0p1-10.el8.tuxcare.els11.x86_64.rpm
sha:d326bca0c2734e4cdae16192f41d3b4d364715c8db76cafba9dcda4f8a66e300
-
openssh-ldap-8.0p1-10.el8.tuxcare.els11.x86_64.rpm
sha:32f5a105fb9bc2c41a432cd68760d4bfbcaaca23de4e6bc379360e524339853c
-
openssh-server-8.0p1-10.el8.tuxcare.els11.x86_64.rpm
sha:3ba04f9337d7390fefa6d5a8162a6a06c4ff131d2f178206c316fe1a95f481a0
-
pam_ssh_agent_auth-0.10.3-7.10.el8.tuxcare.els11.x86_64.rpm
sha:3d5380a6c33ff54629ffe2a4e90247bae8fc2ae33d19c3828110aac5cc48c2c9
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
