Hello misc@! I have some security department in my Company breathing down my neck because I run an OpenBSD 7.9 public server that has got OpenSSH 10.3, and their vulnerability scanning tool Black Kite reports that it is vulnerable to CVE-2026-59999 (high), CVE-2026-60000 (high), and CVE-2026-6002 (critical).
I can find matching descriptions on Https://www.openssh.org/releasenotes.html#10.4, but those OpenSSH release notes do not list the CVE numbers: CVE-2026-59999 (high), should be: * sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes as it was documented to do. Note that PermitTunnel is not enabled by default. Reported independently by Huzaifa Sidhpurwala of Redhat and Marko Jevtic. CVE-2026-60000 (high), should be: * sshd(8): avoid a potential pre-authentication denial of service when GSSAPIAuthentication was enabled (this feature is off by default). This was not mitigated by MaxAuthTries, but would be penalised by PerSourcePenalties. This was reported by Manfred Kaiser of the milCERT AT (Austrian Ministry of Defence). CVE-2026-60002 (critical), should be: * ssh(1): fix a possible client-side use-after-free if the server changes its host key during a key reexchange. This was reported by Zhenpeng (Leo) Lin of Depthfirst. From what I see none of these fixes has been backported to a syspatch for OpenBSD 7.9, so I guess they are not deemed severe enough. Still, Black Kite dares to call them "high" and "critical", and my Company's security department gives me 30 business days for the "high" and 10 for the "critical" to remedy by upgrading to OpenSSH 10.4. I suppose neither of these will be backported to OpenBSD 7.9, and I dare say that none of these bugs is one that the server will encounter... Does misc@ have any advice on how I should handle my security department, or possibly on how to "remedy these CVE:s"...? Best regards -- / Raimo Niskanen, Erlang/OTP, Ericsson AB
