Ubuntu has issued an advisory on April 24: https://ubuntu.com/security/notices/USN-7457-1
Fixed by: https://github.com/openssh/openssh-portable/commit/fc86875e6acb36401dfc1dfb6b628a9d1460f367 (V_10_0_P1)
CVE: (none) => CVE-2025-32728Source RPM: (none) => openssh-9.9p2-1.mga10.src.rpm, openssh-9.3p1-2.4.mga9.src.rpmStatus comment: (none) => Fixed upstream in 10.0p1 and patch available from upstreamWhiteboard: (none) => MGA9TOO
Unsure where to put this, so assigning globally. It is possible NicolasS wlll do it (he did the last CVE update).
Assignee: bugsquad => pkg-bugs
Suggested advisory: ======================== The updated packages fix a security vulnerability: In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding. (CVE-2025-32728) References: https://ubuntu.com/security/notices/USN-7457-1 ======================== Updated packages in core/updates_testing: ======================== openssh-9.3p1-2.5.mga9 openssh-askpass-common-9.3p1-2.5.mga9 openssh-askpass-gnome-9.3p1-2.5.mga9 openssh-clients-9.3p1-2.5.mga9 openssh-keycat-9.3p1-2.5.mga9 openssh-server-9.3p1-2.5.mga9 from SRPM: openssh-9.3p1-2.5.mga9.src.rpm
Whiteboard: MGA9TOO => (none)Status: NEW => ASSIGNEDStatus comment: Fixed upstream in 10.0p1 and patch available from upstream => (none)Version: Cauldron => 9Source RPM: openssh-9.9p2-1.mga10.src.rpm, openssh-9.3p1-2.4.mga9.src.rpm => openssh-9.3p1-2.4.mga9.src.rpmAssignee: pkg-bugs => qa-bugs
CC: (none) => mageia
Keywords: (none) => advisory
I not see DisableForwarding -o option Can be used to give options in the format used in the configuration file. This is useful for specifying options for which there is no separate command-line flag. For full details of the options listed below, and their possible values, see ssh_config5. AddKeysToAgent AddressFamily BatchMode BindAddress BindInterface CanonicalDomains CanonicalizeFallbackLocal CanonicalizeHostname CanonicalizeMaxDots CanonicalizePermittedCNAMEs CASignatureAlgorithms CertificateFile CheckHostIP Ciphers ClearAllForwardings Compression ConnectionAttempts ConnectTimeout ControlMaster ControlPath ControlPersist DynamicForward EnableSSHKeysign EnableEscapeCommandline EscapeChar ExitOnForwardFailure FingerprintHash ForkAfterAuthentication ForwardAgent ForwardX11 ForwardX11Timeout ForwardX11Trusted GatewayPorts GlobalKnownHostsFile GSSAPIAuthentication GSSAPIKeyExchange GSSAPIClientIdentity GSSAPIDelegateCredentials GSSAPIKexAlgorithms GSSAPIRenewalForcesRekey GSSAPIServerIdentity GSSAPITrustDns HashKnownHosts Host HostbasedAcceptedAlgorithms HostbasedAuthentication HostKeyAlgorithms HostKeyAlias Hostname IdentitiesOnly IdentityAgent IdentityFile IgnoreUnknown Include IPQoS KbdInteractiveAuthentication KbdInteractiveDevices KexAlgorithms KnownHostsCommand LocalCommand LocalForward LogLevel LogVerbose MACs Match NoHostAuthenticationForLocalhost NumberOfPasswordPrompts PasswordAuthentication PermitLocalCommand PermitRemoteOpen PKCS11Provider Port PreferredAuthentications ProxyCommand ProxyJump ProxyUseFdpass PubkeyAcceptedAlgorithms PubkeyAuthentication RekeyLimit RemoteCommand RemoteForward RequestTTY RevokedHostKeys SecurityKeyProvider RequiredRSASize SendEnv ServerAliveInterval ServerAliveCountMax SessionType SetEnv StdinNull StreamLocalBindMask StreamLocalBindUnlink StrictHostKeyChecking SyslogFacility TCPKeepAlive Tunnel TunnelDevice UpdateHostKeys User UserKnownHostsFile VerifyHostKeyDNS VisualHostKey XAuthLocation And the options to not forward x11 available -o ForwardX11=no or -x look like works This issue really affects our version ?
MGA9-64 Plasma Wayland on Compaq H000SB No installation issues # systemctl start sshd # systemctl -l status sshd ● sshd.service - OpenSSH server daemon Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; preset: enabled) Active: active (running) since Thu 2025-05-01 11:23:47 CEST; 6s ago Docs: man:sshd(8) man:sshd_config(5) Main PID: 10556 (sshd) Tasks: 1 (limit: 8806) Memory: 1.3M CPU: 141ms CGroup: /system.slice/sshd.service └─10556 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups" May 01 11:23:47 mach3.hviaene.thuis systemd[1]: Starting sshd.service... May 01 11:23:47 mach3.hviaene.thuis sshd[10556]: Server listening on 0.0.0.0 port 22. May 01 11:23:47 mach3.hviaene.thuis sshd[10556]: Server listening on :: port 22. May 01 11:23:47 mach3.hviaene.thuis systemd[1]: Started sshd.service. $ ssh -oHostKeyAlgorithms=+ssh-dss -oPubkeyAcceptedKeyTypes=+ssh-dss me@165.72.193.193 (me@165.72.193.193) Password: seems to work. Generated key and could connect to and from my desktop PC. AFAICS it works OK.
CC: (none) => herman.viaene
RH x86_64 installing openssh-clients-9.3p1-2.5.mga9.x86_64.rpm openssh-server-9.3p1-2.5.mga9.x86_64.rpm openssh-askpass-gnome-9.3p1-2.5.mga9.x86_64.rpm openssh-askpass-common-9.3p1-2.5.mga9.x86_64.rpm openssh-9.3p1-2.5.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64 Preparing... ################################################################################################## 1/5: openssh ################################################################################################## 2/5: openssh-clients ################################################################################################## 3/5: openssh-askpass-common ################################################################################################## 4/5: openssh-askpass-gnome ################################################################################################## 5/5: openssh-server ################################################################################################## 1/5: removing openssh-askpass-gnome-9.3p1-2.4.mga9.x86_64 ################################################################################################## 2/5: removing openssh-server-9.3p1-2.4.mga9.x86_64 ################################################################################################## 3/5: removing openssh-askpass-common-9.3p1-2.4.mga9.x86_64 ################################################################################################## 4/5: removing openssh-clients-9.3p1-2.4.mga9.x86_64 ################################################################################################## 5/5: removing openssh-9.3p1-2.4.mga9.x86_64 ################################################################################################## Still not see DisableForwarding in ssh options systemctl restart sshd systemctl -l status sshd ● sshd.service - OpenSSH server daemon Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; preset: enabled) Active: active (running) since Fri 2025-05-02 12:13:38 CST; 27s ago Docs: man:sshd(8) man:sshd_config(5) Main PID: 39900 (sshd) Tasks: 1 (limit: 6903) Memory: 1.4M CPU: 41ms CGroup: /system.slice/sshd.service └─39900 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups" may 02 12:13:38 jgrey.phoenix systemd[1]: Starting sshd.service... may 02 12:13:38 jgrey.phoenix sshd[39900]: Server listening on 192.168.1.3 port 22. may 02 12:13:38 jgrey.phoenix systemd[1]: Started sshd.service. Umount and mount sshfs mount points Conect to other servers Conect from external server to my server OK as long as not produce side effects , but I still not sure if is something to fix in mageia
CC: (none) => andrewsfarm
Installed and tested without issues. Tested for 3 days on multiple machines and VMs, as client and server, without issues. Tested systems' architectures are x86_64 (Intel and AMD) and ARM arch64. Tested systemd socket activated, port forwarding, X11 forwarding, key authentication, proxy SOCKS5, etc. $ uname -a Linux jupiter 6.6.88-desktop-3.mga9 #1 SMP PREEMPT_DYNAMIC Sat Apr 26 22:17:20 UTC 2025 x86_64 GNU/Linux $ rpm -qa | grep openssh | sort lxqt-openssh-askpass-1.4.0-1.mga9 openssh-9.3p1-2.5.mga9 openssh-askpass-common-9.3p1-2.5.mga9 openssh-askpass-qt5-2.1.0-10.mga9 openssh-clients-9.3p1-2.5.mga9 openssh-server-9.3p1-2.5.mga9 $ systemctl status sshd.socket ● sshd.socket - OpenSSH Server Socket Loaded: loaded (/etc/systemd/system/sshd.socket; enabled; preset: disabled) Active: active (listening) since Mon 2025-05-05 09:38:45 WEST; 31min ago Docs: man:sshd(8) man:sshd_config(5) Listen: [::]:22222 (Stream) Accepted: 0; Connected: 0; Tasks: 0 (limit: 37587) Memory: 8.0K CPU: 464us CGroup: /system.slice/sshd.socket Warning: some journal files were not opened due to insufficient permissions.
MGA9-x86, Xfce The following 2 packages are going to be installed: - openssh-9.3p1-2.5.mga9.x86_64 - openssh-clients-9.3p1-2.5.mga9.x86_64 56B of additional disk space will be used. -- ssh'd into a server - no issues used various functions all worked
CC: (none) => brtians1
I've been using this for a few days on x86_64 without issue.
CC: (none) => dan
Whiteboard: (none) => MGA9-64-OK
Validating.
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2025-0157.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED