{"id":"SUSE-SU-2026:21798-1","summary":"Security update for openssh","details":"This update for openssh fixes the following issues\n\nSecurity issues fixed:\n\n- CVE-2026-35385: a file downloaded by scp may be installed setuid or setgid (bsc#1261427).\n- CVE-2026-35414: mishandling of authorized_keys principals option (bsc#1261430).\n\nOther issues fixed:\n\n- SSH port not reachable on SLES-16.0-CHOST-BYOS since build 1.32 for both x86_64 and aarch64 (bsc#1262555).\n- OpenSSH audit support causes connection lost with parallel sessions (bsc#1252890).\n","modified":"2026-05-28T18:24:01.664283337Z","published":"2026-05-15T11:24:16Z","related":["CVE-2026-35385","CVE-2026-35414"],"upstream":["CVE-2026-35385","CVE-2026-35414"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621798-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1252890"},{"type":"REPORT","url":"https://bugzilla.suse.com/1261427"},{"type":"REPORT","url":"https://bugzilla.suse.com/1261430"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262555"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-35385"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-35414"}],"schema_version":"1.7.5"}