Security update for openssh SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:01638-2 Final 1 1 2025-06-06T10:04:40Z current 2025-06-06T10:04:40Z 2025-06-06T10:04:40Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssh This update for openssh fixes the following issue: Security fixes: - CVE-2025-32728: Fixed logic error in DisableForwarding option (bsc#1241012) Other fixes: - Fix ssh client segfault with GSSAPIKeyExchange=yes in ssh_kex2 due to gssapi proposal not being correctly initialized (bsc#1236826). The problem was introduced in the rebase of the patch for 9.6p1 - Enable --with-logind to call the SetTTY dbus method in systemd. This allows 'wall' to print messages in ssh ttys (bsc#1239671) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/git:latest-2025-1638,Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest-2025-1638,Image SLES15-SP6-2025-1638,Image SLES15-SP6-Azure-3P-2025-1638,Image SLES15-SP6-Azure-Standard-2025-1638,Image SLES15-SP6-BYOS-2025-1638,Image SLES15-SP6-BYOS-EC2-2025-1638,Image SLES15-SP6-BYOS-GCE-2025-1638,Image SLES15-SP6-GCE-2025-1638,Image SLES15-SP6-Hardened-BYOS-2025-1638,Image SLES15-SP6-Hardened-BYOS-EC2-2025-1638,Image SLES15-SP6-Hardened-BYOS-GCE-2025-1638,Image SLES15-SP6-SAP-2025-1638,Image SLES15-SP6-SAP-GCE-2025-1638,Image SLES15-SP6-SAPCAL-2025-1638,Image SLES15-SP6-SAPCAL-GCE-2025-1638,SUSE-2025-1638,SUSE-SLE-Module-Basesystem-15-SP7-2025-1638,SUSE-SLE-Module-Desktop-Applications-15-SP7-2025-1638 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-202501638-2/ Link for SUSE-SU-2025:01638-2 https://lists.suse.com/pipermail/sle-updates/2025-June/040165.html E-Mail link for SUSE-SU-2025:01638-2 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1236826 SUSE Bug 1236826 https://bugzilla.suse.com/1239671 SUSE Bug 1239671 https://bugzilla.suse.com/1241012 SUSE Bug 1241012 https://www.suse.com/security/cve/CVE-2025-32728/ SUSE CVE CVE-2025-32728 page Container suse/git:latest Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest Image SLES15-SP6 Image SLES15-SP6-Azure-3P Image SLES15-SP6-Azure-Standard Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-GCE SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 openssh-clients-9.6p1-150600.6.26.1 openssh-common-9.6p1-150600.6.26.1 openssh-9.6p1-150600.6.26.1 openssh-server-9.6p1-150600.6.26.1 openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 openssh-askpass-gnome-9.6p1-150600.6.26.1 openssh-cavs-9.6p1-150600.6.26.1 openssh-fips-9.6p1-150600.6.26.1 openssh-helpers-9.6p1-150600.6.26.1 openssh-clients-9.6p1-150600.6.26.1 as a component of Container suse/git:latest openssh-common-9.6p1-150600.6.26.1 as a component of Container suse/git:latest openssh-9.6p1-150600.6.26.1 as a component of Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest openssh-clients-9.6p1-150600.6.26.1 as a component of Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest openssh-common-9.6p1-150600.6.26.1 as a component of Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest openssh-server-9.6p1-150600.6.26.1 as a component of Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest openssh-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6 openssh-clients-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6 openssh-common-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6 openssh-server-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6 openssh-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Azure-3P openssh-clients-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Azure-3P openssh-common-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Azure-3P openssh-server-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Azure-3P openssh-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Azure-Standard openssh-clients-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Azure-Standard openssh-common-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Azure-Standard openssh-server-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Azure-Standard openssh-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-BYOS openssh-clients-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-BYOS openssh-common-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-BYOS openssh-server-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-BYOS openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-BYOS openssh-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-BYOS-EC2 openssh-clients-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-BYOS-EC2 openssh-common-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-BYOS-EC2 openssh-server-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-BYOS-EC2 openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-BYOS-EC2 openssh-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-BYOS-GCE openssh-clients-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-BYOS-GCE openssh-common-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-BYOS-GCE openssh-server-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-BYOS-GCE openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-BYOS-GCE openssh-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-GCE openssh-clients-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-GCE openssh-common-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-GCE openssh-server-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-GCE openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-GCE openssh-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Hardened-BYOS openssh-clients-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Hardened-BYOS openssh-common-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Hardened-BYOS openssh-server-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Hardened-BYOS openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Hardened-BYOS openssh-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Hardened-BYOS-EC2 openssh-clients-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Hardened-BYOS-EC2 openssh-common-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Hardened-BYOS-EC2 openssh-server-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Hardened-BYOS-EC2 openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Hardened-BYOS-EC2 openssh-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Hardened-BYOS-GCE openssh-clients-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Hardened-BYOS-GCE openssh-common-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Hardened-BYOS-GCE openssh-server-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Hardened-BYOS-GCE openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-Hardened-BYOS-GCE openssh-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAP openssh-clients-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAP openssh-common-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAP openssh-server-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAP openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAP openssh-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAP-GCE openssh-clients-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAP-GCE openssh-common-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAP-GCE openssh-server-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAP-GCE openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAP-GCE openssh-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAPCAL openssh-clients-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAPCAL openssh-common-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAPCAL openssh-server-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAPCAL openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAPCAL openssh-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAPCAL-GCE openssh-clients-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAPCAL-GCE openssh-common-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAPCAL-GCE openssh-server-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAPCAL-GCE openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 as a component of Image SLES15-SP6-SAPCAL-GCE openssh-9.6p1-150600.6.26.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 openssh-clients-9.6p1-150600.6.26.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 openssh-common-9.6p1-150600.6.26.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 openssh-fips-9.6p1-150600.6.26.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 openssh-helpers-9.6p1-150600.6.26.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 openssh-server-9.6p1-150600.6.26.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 openssh-askpass-gnome-9.6p1-150600.6.26.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7 In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding. CVE-2025-32728 Container suse/git:latest:openssh-clients-9.6p1-150600.6.26.1 Container suse/git:latest:openssh-common-9.6p1-150600.6.26.1 Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest:openssh-9.6p1-150600.6.26.1 Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest:openssh-clients-9.6p1-150600.6.26.1 Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest:openssh-common-9.6p1-150600.6.26.1 Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest:openssh-server-9.6p1-150600.6.26.1 Image SLES15-SP6-Azure-3P:openssh-9.6p1-150600.6.26.1 Image SLES15-SP6-Azure-3P:openssh-clients-9.6p1-150600.6.26.1 Image SLES15-SP6-Azure-3P:openssh-common-9.6p1-150600.6.26.1 Image SLES15-SP6-Azure-3P:openssh-server-9.6p1-150600.6.26.1 Image SLES15-SP6-Azure-Standard:openssh-9.6p1-150600.6.26.1 Image SLES15-SP6-Azure-Standard:openssh-clients-9.6p1-150600.6.26.1 Image SLES15-SP6-Azure-Standard:openssh-common-9.6p1-150600.6.26.1 Image SLES15-SP6-Azure-Standard:openssh-server-9.6p1-150600.6.26.1 Image SLES15-SP6-BYOS-EC2:openssh-9.6p1-150600.6.26.1 Image SLES15-SP6-BYOS-EC2:openssh-clients-9.6p1-150600.6.26.1 Image SLES15-SP6-BYOS-EC2:openssh-common-9.6p1-150600.6.26.1 Image SLES15-SP6-BYOS-EC2:openssh-server-9.6p1-150600.6.26.1 Image SLES15-SP6-BYOS-EC2:openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 Image SLES15-SP6-BYOS-GCE:openssh-9.6p1-150600.6.26.1 Image SLES15-SP6-BYOS-GCE:openssh-clients-9.6p1-150600.6.26.1 Image SLES15-SP6-BYOS-GCE:openssh-common-9.6p1-150600.6.26.1 Image SLES15-SP6-BYOS-GCE:openssh-server-9.6p1-150600.6.26.1 Image SLES15-SP6-BYOS-GCE:openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 Image SLES15-SP6-BYOS:openssh-9.6p1-150600.6.26.1 Image SLES15-SP6-BYOS:openssh-clients-9.6p1-150600.6.26.1 Image SLES15-SP6-BYOS:openssh-common-9.6p1-150600.6.26.1 Image SLES15-SP6-BYOS:openssh-server-9.6p1-150600.6.26.1 Image SLES15-SP6-BYOS:openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 Image SLES15-SP6-GCE:openssh-9.6p1-150600.6.26.1 Image SLES15-SP6-GCE:openssh-clients-9.6p1-150600.6.26.1 Image SLES15-SP6-GCE:openssh-common-9.6p1-150600.6.26.1 Image SLES15-SP6-GCE:openssh-server-9.6p1-150600.6.26.1 Image SLES15-SP6-GCE:openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 Image SLES15-SP6-Hardened-BYOS-EC2:openssh-9.6p1-150600.6.26.1 Image SLES15-SP6-Hardened-BYOS-EC2:openssh-clients-9.6p1-150600.6.26.1 Image SLES15-SP6-Hardened-BYOS-EC2:openssh-common-9.6p1-150600.6.26.1 Image SLES15-SP6-Hardened-BYOS-EC2:openssh-server-9.6p1-150600.6.26.1 Image SLES15-SP6-Hardened-BYOS-EC2:openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 Image SLES15-SP6-Hardened-BYOS-GCE:openssh-9.6p1-150600.6.26.1 Image SLES15-SP6-Hardened-BYOS-GCE:openssh-clients-9.6p1-150600.6.26.1 Image SLES15-SP6-Hardened-BYOS-GCE:openssh-common-9.6p1-150600.6.26.1 Image SLES15-SP6-Hardened-BYOS-GCE:openssh-server-9.6p1-150600.6.26.1 Image SLES15-SP6-Hardened-BYOS-GCE:openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 Image SLES15-SP6-Hardened-BYOS:openssh-9.6p1-150600.6.26.1 Image SLES15-SP6-Hardened-BYOS:openssh-clients-9.6p1-150600.6.26.1 Image SLES15-SP6-Hardened-BYOS:openssh-common-9.6p1-150600.6.26.1 Image SLES15-SP6-Hardened-BYOS:openssh-server-9.6p1-150600.6.26.1 Image SLES15-SP6-Hardened-BYOS:openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 Image SLES15-SP6-SAP-GCE:openssh-9.6p1-150600.6.26.1 Image SLES15-SP6-SAP-GCE:openssh-clients-9.6p1-150600.6.26.1 Image SLES15-SP6-SAP-GCE:openssh-common-9.6p1-150600.6.26.1 Image SLES15-SP6-SAP-GCE:openssh-server-9.6p1-150600.6.26.1 Image SLES15-SP6-SAP-GCE:openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 Image SLES15-SP6-SAP:openssh-9.6p1-150600.6.26.1 Image SLES15-SP6-SAP:openssh-clients-9.6p1-150600.6.26.1 Image SLES15-SP6-SAP:openssh-common-9.6p1-150600.6.26.1 Image SLES15-SP6-SAP:openssh-server-9.6p1-150600.6.26.1 Image SLES15-SP6-SAP:openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 Image SLES15-SP6-SAPCAL-GCE:openssh-9.6p1-150600.6.26.1 Image SLES15-SP6-SAPCAL-GCE:openssh-clients-9.6p1-150600.6.26.1 Image SLES15-SP6-SAPCAL-GCE:openssh-common-9.6p1-150600.6.26.1 Image SLES15-SP6-SAPCAL-GCE:openssh-server-9.6p1-150600.6.26.1 Image SLES15-SP6-SAPCAL-GCE:openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 Image SLES15-SP6-SAPCAL:openssh-9.6p1-150600.6.26.1 Image SLES15-SP6-SAPCAL:openssh-clients-9.6p1-150600.6.26.1 Image SLES15-SP6-SAPCAL:openssh-common-9.6p1-150600.6.26.1 Image SLES15-SP6-SAPCAL:openssh-server-9.6p1-150600.6.26.1 Image SLES15-SP6-SAPCAL:openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 Image SLES15-SP6:openssh-9.6p1-150600.6.26.1 Image SLES15-SP6:openssh-clients-9.6p1-150600.6.26.1 Image SLES15-SP6:openssh-common-9.6p1-150600.6.26.1 Image SLES15-SP6:openssh-server-9.6p1-150600.6.26.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:openssh-9.6p1-150600.6.26.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:openssh-clients-9.6p1-150600.6.26.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:openssh-common-9.6p1-150600.6.26.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:openssh-fips-9.6p1-150600.6.26.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:openssh-helpers-9.6p1-150600.6.26.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:openssh-server-9.6p1-150600.6.26.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:openssh-server-config-disallow-rootlogin-9.6p1-150600.6.26.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP7:openssh-askpass-gnome-9.6p1-150600.6.26.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202501638-2/ https://www.suse.com/security/cve/CVE-2025-32728.html CVE-2025-32728 https://bugzilla.suse.com/1241012 SUSE Bug 1241012