CVE-2025-32728

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \ capabilities, several authentication methods, and sophisticated configuration options.

Security Fix(es):

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.(CVE-2025-26465)

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.(CVE-2025-32728)

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \ capabilities, several authentication methods, and sophisticated configuration options.

Security Fix(es):

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.(CVE-2025-26465)

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.(CVE-2025-32728)

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \ capabilities, several authentication methods, and sophisticated configuration options.

Security Fix(es):

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.(CVE-2025-32728)

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \ capabilities, several authentication methods, and sophisticated configuration options.

Security Fix(es):

OpenSSH (OpenBSD Secure Shell) is a set of connection tools for secure access to remote computers in the Canadian OpenBSD program group. This tool is an open source implementation of the SSH protocol, supports encryption of all transmissions, and can effectively prevent eavesdropping, connection hijacking, and other network-level attacks. OpenSSH (OpenBSD Secure Shell) versions before 10.0 have a security vulnerability that originated from the DisableForwarding directive that does not correctly disable X11 and proxy forwarding.(CVE-2025-32728)

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \ capabilities, several authentication methods, and sophisticated configuration options.

Security Fix(es):

OpenSSH (OpenBSD Secure Shell) is a set of connection tools for secure access to remote computers in the Canadian OpenBSD program group. This tool is an open source implementation of the SSH protocol, supports encryption of all transmissions, and can effectively prevent eavesdropping, connection hijacking, and other network-level attacks. OpenSSH (OpenBSD Secure Shell) versions before 10.0 have a security vulnerability that originated from the DisableForwarding directive that does not correctly disable X11 and proxy forwarding.(CVE-2025-32728)

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es):

• openssh: OpenSSH SSHD Agent Forwarding and X11 Forwarding (CVE-2025-32728)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es):

• openssh: OpenSSH SSHD Agent Forwarding and X11 Forwarding (CVE-2025-32728)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2025-32728: fix logic error in DisableForwarding option

• CVE-2025-32728: fix logic error in DisableForwarding option

• CVE-2025-32728: fix logic error in DisableForwarding option

• CVE-2025-32728: fix logic error in DisableForwarding option

• CVE-2025-32728: fix logic error in DisableForwarding option

• SECURITY UPDATE: DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.
  • debian/patches/CVE-2025-32728.patch: fix logic error in DisableForwarding option
  • CVE-2025-32728

• CVE-2025-32728: fix logic error in DisableForwarding option

• SECURITY UPDATE: DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.
  • debian/patches/CVE-2025-32728.patch: fix logic error in DisableForwarding option
  • CVE-2025-32728

• CVE-2025-32728: fix logic error in DisableForwarding option

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding. (CVE-2025-32728)

These are all security issues fixed in the openssh-10.0p2-2.1 package on the GA media of openSUSE Tumbleweed.

This update for openssh fixes the following issue:

Security fixes:

• CVE-2025-32728: Fixed logic error in DisableForwarding option (bsc#1241012)

Other fixes:

• Fix ssh client segfault with GSSAPIKeyExchange=yes in ssh_kex2 due to gssapi proposal not being correctly initialized (bsc#1236826). The problem was introduced in the rebase of the patch for 9.6p1
• Enable --with-logind to call the SetTTY dbus method in systemd. This allows 'wall' to print messages in ssh ttys (bsc#1239671)

This update for openssh fixes the following issue:

Security fixes:

• CVE-2025-32728: Fixed logic error in DisableForwarding option (bsc#1241012)

Other fixes:

• Fix ssh client segfault with GSSAPIKeyExchange=yes in ssh_kex2 due to gssapi proposal not being correctly initialized (bsc#1236826). The problem was introduced in the rebase of the patch for 9.6p1
• Enable --with-logind to call the SetTTY dbus method in systemd. This allows 'wall' to print messages in ssh ttys (bsc#1239671)

This update for openssh fixes the following issues:

• Security issues fixed:

  • CVE-2025-32728: Fixed a logic error in DisableForwarding option (bsc#1241012)

• Other bugs fixed:

  • Allow KEX hashes greater than 256 bits (bsc#1241045)
  • Fixed hostname being left out of the audit output (bsc#1228634)
  • Fixed failures with very large MOTDs (bsc#1232533)

This update for openssh fixes the following issues:

• CVE-2025-32728: fix logic error in DisableForwarding option (bsc#1241012).
• CVE-2026-3497: information disclosure or denial of service due to uninitialized variables (bsc#1259642).
• CVE-2026-35385: a file downloaded by scp may be installed setuid or setgid (bsc#1261427).

Other issues fixed::

• ignores write permissions for Group and World Directory Permissions (bsc#1241667).
• wall tool not longer printing any message to terminals (bsc#1239671)
• potential issue in validating mac (bsc#1264568):

• Improve %prep LDAP regex to preserve subdirectories (e.g., ope- nbsd-compat/) and handle optional [ab]/ prefixes.

It was discovered that OpenSSH incorrectly handled the DisableForwarding directive. The directive would fail to disable X11 and agent forwarding, contrary to documentation and expectations.