AI analysis
In sshd in OpenSSH before 10.6, GSSAPIAuthentication state can be incorrectly kept and reused across separate authentication attempts (CWE-669). The issue is reachable over the network with no privileges and no user interaction. CVSS 3.1 rates it 7.5 (high) with high integrity impact and no confidentiality or availability impact, so a remote attacker may be able to corrupt or carry over GSSAPI authentication state and undermine login integrity. Anyone running OpenSSH sshd older than 10.6 is affected, especially where GSSAPIAuthentication is enabled. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Upgrade OpenSSH to 10.6 or later (apply the Ubuntu updates from USN-8928-1 where that notice applies). Until then, set GSSAPIAuthentication to no in sshd_config and restart sshd if Kerberos/GSSAPI login is not required, and review auth logs for unexpected GSSAPI successes.
Affected
| OpenBSD OpenSSH | before 10.6 |
Estimated exposure
masstens of millions of OpenSSH sshd installs (on the order of 10M+ internet-exposed SSH services; GSSAPI-enabled hosts are a smaller subset) — OpenSSH sshd is the default SSH server on most Unix-like systems; public internet scans commonly show on the order of tens of millions of exposed SSH services, though GSSAPIAuthentication is optional and not enabled on every host.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.