[Git][security-tracker-team/security-tracker][master] Add initial tracking for openssh issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
3390a5ad by Salvatore Bonaccorso at 2026-10-07T09:26:16+02:00
Add initial tracking for openssh issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -203,27 +203,38 @@ CVE-2026-16516 (wolfSSH does not validate that the ECDSA curve identifier in a K
 CVE-2026-14911 (Improper Neutralization of Input During Web Page Generation (\u201cCro ...)
 	NOT-FOR-US: ASUS
 CVE-2026-106589 (In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 ...)
-	TODO: check
+	- openssh 1:10.6p1-1
+	NOTE: https://www.openssh.org/releasenotes.html#10.6
 CVE-2026-106588 (In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK ha ...)
-	TODO: check
+	- openssh <not-affected> (Only affects OpenSSH on macOS)
+	NOTE: https://www.openssh.org/releasenotes.html#10.6
 CVE-2026-106587 (In sshd in OpenSSH before 10.6, the value "none" for a configuration o ...)
-	TODO: check
+	- openssh 1:10.6p1-1
+	NOTE: https://www.openssh.org/releasenotes.html#10.6
 CVE-2026-106586 (In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_ke ...)
-	TODO: check
+	- openssh 1:10.6p1-1
+	NOTE: https://www.openssh.org/releasenotes.html#10.6
 CVE-2026-106585 (In sshd and ssh in OpenSSH before 10.6, there is no check for whether  ...)
-	TODO: check
+	- openssh 1:10.6p1-1
+	NOTE: https://www.openssh.org/releasenotes.html#10.6
 CVE-2026-106584 (In ssh-keygen in OpenSSH before 10.6, certificates could have incorrec ...)
-	TODO: check
+	- openssh 1:10.6p1-1
+	NOTE: https://www.openssh.org/releasenotes.html#10.6
 CVE-2026-106583 (In ssh in OpenSSH before 10.6, a $ or \ character can occur in a comma ...)
-	TODO: check
+	- openssh 1:10.6p1-1
+	NOTE: https://www.openssh.org/releasenotes.html#10.6
 CVE-2026-106582 (In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can b ...)
-	TODO: check
+	- openssh 1:10.6p1-1
+	NOTE: https://www.openssh.org/releasenotes.html#10.6
 CVE-2026-106555 (In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication st ...)
-	TODO: check
+	- openssh 1:10.6p1-1
+	NOTE: https://www.openssh.org/releasenotes.html#10.6
 CVE-2026-106553 (In sshd in OpenSSH before 10.6, credentials can incorrectly persist af ...)
-	TODO: check
+	- openssh 1:10.6p1-1
+	NOTE: https://www.openssh.org/releasenotes.html#10.6
 CVE-2026-106552 (In sftp in OpenSSH before 10.6, a server can trigger directory travers ...)
-	TODO: check
+	- openssh 1:10.6p1-1
+	NOTE: https://www.openssh.org/releasenotes.html#10.6
 CVE-2026-106550 (Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a De ...)
 	TODO: check
 CVE-2026-106547 (A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3390a5ad98e1d9db74eaae2f0604a350b11d61e4

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3390a5ad98e1d9db74eaae2f0604a350b11d61e4
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261007/a0f8fbe2/attachment-0001.htm>