USN-8928-1: OpenSSH vulnerabilities
Ubuntu patched OpenSSH flaws that could allow unintended SFTP writes or leak GSSAPI credentials.
Ubuntu security notice USN-8928-1 covers multiple OpenSSH vulnerabilities. CVE-2026-106552 is an sftp-client path-handling flaw during recursive copy that a remote attacker controlling the server could use to write files to unintended locations. CVE-2026-106553 and CVE-2026-106555 involve sshd mishandling GSSAPIAuthentication state across attempts, which could expose credentials from a previous failed login. The notice also says incorrect use of an LZ77 dictionary coder during compression could let an attacker obtain sensitive information. No exploitation is reported.
36