Nixpkgs security tracker

Permalink CVE-2026-35385

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 3 weeks ago
@LeSuisse ignored
7 packages
- opensshTest
- openssh-askpass
- perlPackages.NetOpenSSH
- perl5Packages.NetOpenSSH
- lxqt.lxqt-openssh-askpass
- perl538Packages.NetOpenSSH
- perl540Packages.NetOpenSSH
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

In OpenSSH before 10.3, a file downloaded by scp may …

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

References

Ignored references (1)

https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2

Affected products

OpenSSH

<10.3

Matching in nixpkgs

pkgs.openssh

Implementation of the SSH protocol

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.openssh_hpn

Implementation of the SSH protocol with high performance networking patches

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.openssh_gssapi

Implementation of the SSH protocol with GSSAPI support

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.opensshWithKerberos

Implementation of the SSH protocol

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.openssh_hpnWithKerberos

Implementation of the SSH protocol with high performance networking patches

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

Ignored packages (7)

pkgs.opensshTest

Implementation of the SSH protocol

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.openssh-askpass

A passphrase dialog for OpenSSH and GTK

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.perlPackages.NetOpenSSH

Perl SSH client package implemented on top of OpenSSH

nixos-unstable 0.84
- nixpkgs-unstable 0.84
- nixos-unstable-small 0.84

pkgs.perl5Packages.NetOpenSSH

Perl SSH client package implemented on top of OpenSSH

nixos-unstable 0.84
- nixpkgs-unstable 0.84
- nixos-unstable-small 0.84

pkgs.lxqt.lxqt-openssh-askpass

GUI to query passwords on behalf of SSH agents

nixos-unstable 2.3.0
- nixpkgs-unstable 2.3.0
- nixos-unstable-small 2.3.0

pkgs.perl538Packages.NetOpenSSH

None

pkgs.perl540Packages.NetOpenSSH

None

Package maintainers

@balsoft Alexander Bantyev <balsoft75@gmail.com>
@philiptaron Philip Taron <philip.taron@gmail.com>
@dasJ Janne Heß <janne@hess.ooo>
@helsinki-Jo Joachim Ernst <joachim.ernst@helsinki-systems.de>
@pyrox0 Pyrox <pyrox@pyrox.dev>
@numinit Morgan Jones <me+nixpkgs@numin.it>
@infinisil Silvan Mosberger <contact@infinisil.com>
@wahjava Ashish SHUKLA <ashish.is@lostca.se>

Permalink CVE-2026-35414

4.2 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 3 weeks ago
@LeSuisse ignored
7 packages
- opensshTest
- openssh-askpass
- perlPackages.NetOpenSSH
- perl5Packages.NetOpenSSH
- lxqt.lxqt-openssh-askpass
- perl538Packages.NetOpenSSH
- perl540Packages.NetOpenSSH
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon …

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

References

Ignored references (1)

https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2

Affected products

OpenSSH

<10.3

Matching in nixpkgs

pkgs.openssh

Implementation of the SSH protocol

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.openssh_hpn

Implementation of the SSH protocol with high performance networking patches

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.openssh_gssapi

Implementation of the SSH protocol with GSSAPI support

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.opensshWithKerberos

Implementation of the SSH protocol

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.openssh_hpnWithKerberos

Implementation of the SSH protocol with high performance networking patches

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

Ignored packages (7)

pkgs.opensshTest

Implementation of the SSH protocol

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.openssh-askpass

A passphrase dialog for OpenSSH and GTK

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.perlPackages.NetOpenSSH

Perl SSH client package implemented on top of OpenSSH

nixos-unstable 0.84
- nixpkgs-unstable 0.84
- nixos-unstable-small 0.84

pkgs.perl5Packages.NetOpenSSH

Perl SSH client package implemented on top of OpenSSH

nixos-unstable 0.84
- nixpkgs-unstable 0.84
- nixos-unstable-small 0.84

pkgs.lxqt.lxqt-openssh-askpass

GUI to query passwords on behalf of SSH agents

nixos-unstable 2.3.0
- nixpkgs-unstable 2.3.0
- nixos-unstable-small 2.3.0

pkgs.perl538Packages.NetOpenSSH

None

pkgs.perl540Packages.NetOpenSSH

None

Package maintainers

@balsoft Alexander Bantyev <balsoft75@gmail.com>
@philiptaron Philip Taron <philip.taron@gmail.com>
@dasJ Janne Heß <janne@hess.ooo>
@helsinki-Jo Joachim Ernst <joachim.ernst@helsinki-systems.de>
@pyrox0 Pyrox <pyrox@pyrox.dev>
@numinit Morgan Jones <me+nixpkgs@numin.it>
@infinisil Silvan Mosberger <contact@infinisil.com>
@wahjava Ashish SHUKLA <ashish.is@lostca.se>

Permalink CVE-2026-35388

2.5 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 3 weeks ago
@LeSuisse ignored
7 packages
- opensshTest
- openssh-askpass
- perlPackages.NetOpenSSH
- perl5Packages.NetOpenSSH
- lxqt.lxqt-openssh-askpass
- perl538Packages.NetOpenSSH
- perl540Packages.NetOpenSSH
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing …

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

References

Ignored references (1)

https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2

Affected products

OpenSSH

<10.3

Matching in nixpkgs

pkgs.openssh

Implementation of the SSH protocol

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.openssh_hpn

Implementation of the SSH protocol with high performance networking patches

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.openssh_gssapi

Implementation of the SSH protocol with GSSAPI support

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.opensshWithKerberos

Implementation of the SSH protocol

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.openssh_hpnWithKerberos

Implementation of the SSH protocol with high performance networking patches

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

Ignored packages (7)

pkgs.opensshTest

Implementation of the SSH protocol

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.openssh-askpass

A passphrase dialog for OpenSSH and GTK

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.perlPackages.NetOpenSSH

Perl SSH client package implemented on top of OpenSSH

nixos-unstable 0.84
- nixpkgs-unstable 0.84
- nixos-unstable-small 0.84

pkgs.perl5Packages.NetOpenSSH

Perl SSH client package implemented on top of OpenSSH

nixos-unstable 0.84
- nixpkgs-unstable 0.84
- nixos-unstable-small 0.84

pkgs.lxqt.lxqt-openssh-askpass

GUI to query passwords on behalf of SSH agents

nixos-unstable 2.3.0
- nixpkgs-unstable 2.3.0
- nixos-unstable-small 2.3.0

pkgs.perl538Packages.NetOpenSSH

None

pkgs.perl540Packages.NetOpenSSH

None

Package maintainers

@balsoft Alexander Bantyev <balsoft75@gmail.com>
@philiptaron Philip Taron <philip.taron@gmail.com>
@dasJ Janne Heß <janne@hess.ooo>
@helsinki-Jo Joachim Ernst <joachim.ernst@helsinki-systems.de>
@pyrox0 Pyrox <pyrox@pyrox.dev>
@numinit Morgan Jones <me+nixpkgs@numin.it>
@infinisil Silvan Mosberger <contact@infinisil.com>
@wahjava Ashish SHUKLA <ashish.is@lostca.se>

Permalink CVE-2026-35386

3.6 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 3 weeks ago
@LeSuisse ignored
7 packages
- opensshTest
- openssh-askpass
- perlPackages.NetOpenSSH
- perl5Packages.NetOpenSSH
- lxqt.lxqt-openssh-askpass
- perl538Packages.NetOpenSSH
- perl540Packages.NetOpenSSH
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

In OpenSSH before 10.3, command execution can occur via shell …

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.

References

Ignored references (1)

https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2

Affected products

OpenSSH

<10.3

Matching in nixpkgs

pkgs.openssh

Implementation of the SSH protocol

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.openssh_hpn

Implementation of the SSH protocol with high performance networking patches

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.openssh_gssapi

Implementation of the SSH protocol with GSSAPI support

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.opensshWithKerberos

Implementation of the SSH protocol

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.openssh_hpnWithKerberos

Implementation of the SSH protocol with high performance networking patches

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

Ignored packages (7)

pkgs.opensshTest

Implementation of the SSH protocol

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.openssh-askpass

A passphrase dialog for OpenSSH and GTK

nixos-unstable 10.2p1
- nixpkgs-unstable 10.2p1
- nixos-unstable-small 10.2p1

pkgs.perlPackages.NetOpenSSH

Perl SSH client package implemented on top of OpenSSH

nixos-unstable 0.84
- nixpkgs-unstable 0.84
- nixos-unstable-small 0.84

pkgs.perl5Packages.NetOpenSSH

Perl SSH client package implemented on top of OpenSSH

nixos-unstable 0.84
- nixpkgs-unstable 0.84
- nixos-unstable-small 0.84

pkgs.lxqt.lxqt-openssh-askpass

GUI to query passwords on behalf of SSH agents

nixos-unstable 2.3.0
- nixpkgs-unstable 2.3.0
- nixos-unstable-small 2.3.0

pkgs.perl538Packages.NetOpenSSH

None

pkgs.perl540Packages.NetOpenSSH

None

Package maintainers

@balsoft Alexander Bantyev <balsoft75@gmail.com>
@philiptaron Philip Taron <philip.taron@gmail.com>
@dasJ Janne Heß <janne@hess.ooo>
@helsinki-Jo Joachim Ernst <joachim.ernst@helsinki-systems.de>
@pyrox0 Pyrox <pyrox@pyrox.dev>
@numinit Morgan Jones <me+nixpkgs@numin.it>
@infinisil Silvan Mosberger <contact@infinisil.com>
@wahjava Ashish SHUKLA <ashish.is@lostca.se>

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.openssh

pkgs.openssh_hpn

pkgs.openssh_gssapi

pkgs.opensshWithKerberos

pkgs.openssh_hpnWithKerberos

pkgs.opensshTest

pkgs.openssh-askpass

pkgs.perlPackages.NetOpenSSH

pkgs.perl5Packages.NetOpenSSH

pkgs.lxqt.lxqt-openssh-askpass

pkgs.perl538Packages.NetOpenSSH

pkgs.perl540Packages.NetOpenSSH

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.openssh

pkgs.openssh_hpn

pkgs.openssh_gssapi

pkgs.opensshWithKerberos

pkgs.openssh_hpnWithKerberos

pkgs.opensshTest

pkgs.openssh-askpass

pkgs.perlPackages.NetOpenSSH

pkgs.perl5Packages.NetOpenSSH

pkgs.lxqt.lxqt-openssh-askpass

pkgs.perl538Packages.NetOpenSSH

pkgs.perl540Packages.NetOpenSSH

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.openssh

pkgs.openssh_hpn

pkgs.openssh_gssapi

pkgs.opensshWithKerberos

pkgs.openssh_hpnWithKerberos

pkgs.opensshTest

pkgs.openssh-askpass

pkgs.perlPackages.NetOpenSSH

pkgs.perl5Packages.NetOpenSSH

pkgs.lxqt.lxqt-openssh-askpass

pkgs.perl538Packages.NetOpenSSH

pkgs.perl540Packages.NetOpenSSH

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.openssh

pkgs.openssh_hpn

pkgs.openssh_gssapi

pkgs.opensshWithKerberos

pkgs.openssh_hpnWithKerberos

pkgs.opensshTest

pkgs.openssh-askpass

pkgs.perlPackages.NetOpenSSH

pkgs.perl5Packages.NetOpenSSH

pkgs.lxqt.lxqt-openssh-askpass

pkgs.perl538Packages.NetOpenSSH

pkgs.perl540Packages.NetOpenSSH

Package maintainers