Following a brief testing phase in late March 2026, this major update addresses several high-impact vulnerabilities, with the most urgent being a dangerous shell injection flaw in the SSH client.
The centerpiece of this release is the patching of a shell injection vulnerability discovered in OpenSSH’s SSH client.
Attackers could craft malicious usernames passed via the command line to execute arbitrary shell commands when configuration files used specific tokens, such as %u.
OpenSSH 10.3 resolves this by enforcing stricter validation rules for shell characters, effectively closing this attack vector.
Developers, however, continue to strongly advise against directly exposing SSH command lines to untrusted input as a matter of security hygiene.
Beyond the headline fix, OpenSSH 10.3 addresses three other notable security issues:
sshd allowed certificates with comma-separated names to bypass certain restrictions defined in the authorized_keys file now corrected.scp that failed to clear the dangerous setuid/setgid Permission bits when downloading files as root has been remediated.OpenSSH 10.3 also ships with operational improvements designed to enhance connection management and harden servers against automated attacks:
~I and ssh -Oconninfo) let users instantly view details about active SSH connections and open channels.invaliduser penalty automatically throttles bots and attackers attempting logins with invalid usernames.RevokedHostKeys and RevokedKeys configurations now support multiple files, improving compromised key management.PerSourcePenalties The feature now supports decimal time values, enabling defensive blocks shorter than one full second.This release also introduces several compatibility-breaking changes. OpenSSH 10.3 officially drops support for older software implementations that lack cryptographic rekeying support.
Additionally, the ProxyJump command-line option now strictly validates hostnames and usernames to prevent further shell injection risks.
Notably, an empty principals field in a certificate no longer functions as a wildcard it now strictly matches nothing.
Organizations running OpenSSH are strongly urged to upgrade both their servers and clients to version 10.3 without delay to mitigate exposure to these newly disclosed vulnerabilities.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
The post OpenSSH 10.3 Fixes Critical Shell Injection and Security Flaws appeared first on Cyber Security News.
As OpenAI introduces advertisements to its free tier, cybercriminals are seizing the opportunity to trick…
A botnet that has been running since 2011 is back in the spotlight — not…
A new malware has been quietly spreading across cybercrime networks, and security researchers say it…
Illinois generates about 54% of its electricity from nuclear power, but that share could decline…
50 Years Ago The Northampton City Council last night took under advisement Charles J. Eberlein’s…
AMHERST — Reductions in federal funding for research and development could negatively impact the Massachusetts…
This website uses cookies.