QSN-8721-1: OpenSSH vulnerabilities
2026-09-03

Summary:
Several security issues were fixed in OpenSSH.

Details:
It was discovered that OpenSSH's ssh-agent incorrectly handled interactions
between agent locking and the session-bind@openssh.com extension. A remote
attacker with access to a forwarded agent connection could possibly use
this issue to perform operations that should only be available locally,
such as adding tokens or using keys. (CVE-2026-73281)

It was discovered that OpenSSH's ssh client incorrectly handled concurrent
remote-forwarding operations. A remote attacker could possibly use this
issue to cause a use-after-free condition, resulting in a denial of service
or the execution of arbitrary code. (CVE-2026-73282)

It was discovered that OpenSSH's sshd server incorrectly applied the
restrict keyword from authorized_keys to tunnel forwarding requests. A
local attacker with an authorized key could possibly use this issue to
bypass intended tunnel forwarding restrictions. (CVE-2026-73283)

Affected QuantaStor releases:
  6.9.1.001 jammy: openssh-client 1:8.9p1-3ubuntu0.18 (fixed in 1:8.9p1-3ubuntu0.17)
  6.9.1.001 jammy: openssh-server 1:8.9p1-3ubuntu0.18 (fixed in 1:8.9p1-3ubuntu0.17)
  6.9.1.001 jammy: openssh-sftp-server 1:8.9p1-3ubuntu0.18 (fixed in 1:8.9p1-3ubuntu0.17)
  6.9.0.464 jammy: openssh-client 1:8.9p1-3ubuntu0.18 (fixed in 1:8.9p1-3ubuntu0.17)
  6.9.0.464 jammy: openssh-server 1:8.9p1-3ubuntu0.18 (fixed in 1:8.9p1-3ubuntu0.17)
  6.9.0.464 jammy: openssh-sftp-server 1:8.9p1-3ubuntu0.18 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.6.015 jammy: openssh-client 1:8.9p1-3ubuntu0.17 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.6.015 jammy: openssh-server 1:8.9p1-3ubuntu0.17 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.6.015 jammy: openssh-sftp-server 1:8.9p1-3ubuntu0.17 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.5.018 jammy: openssh-client 1:8.9p1-3ubuntu0.16 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.5.018 jammy: openssh-server 1:8.9p1-3ubuntu0.16 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.5.018 jammy: openssh-sftp-server 1:8.9p1-3ubuntu0.16 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.4.038 jammy: openssh-client 1:8.9p1-3ubuntu0.16 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.4.038 jammy: openssh-server 1:8.9p1-3ubuntu0.16 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.4.038 jammy: openssh-sftp-server 1:8.9p1-3ubuntu0.16 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.3.018 jammy: openssh-client 1:8.9p1-3ubuntu0.16 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.3.018 jammy: openssh-server 1:8.9p1-3ubuntu0.16 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.3.018 jammy: openssh-sftp-server 1:8.9p1-3ubuntu0.16 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.2.002 jammy: openssh-client 1:8.9p1-3ubuntu0.16 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.2.002 jammy: openssh-server 1:8.9p1-3ubuntu0.16 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.2.002 jammy: openssh-sftp-server 1:8.9p1-3ubuntu0.16 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.1.007 jammy: openssh-client 1:8.9p1-3ubuntu0.16 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.1.007 jammy: openssh-server 1:8.9p1-3ubuntu0.16 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.1.007 jammy: openssh-sftp-server 1:8.9p1-3ubuntu0.16 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.0.205 jammy: openssh-client 1:8.9p1-3ubuntu0.15 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.0.205 jammy: openssh-server 1:8.9p1-3ubuntu0.15 (fixed in 1:8.9p1-3ubuntu0.17)
  6.8.0.205 jammy: openssh-sftp-server 1:8.9p1-3ubuntu0.15 (fixed in 1:8.9p1-3ubuntu0.17)

CVEs: CVE-2026-73281, CVE-2026-73283, CVE-2026-73282

References:
  https://ubuntu.com/security/notices/USN-8721-1