Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-59997
4.2 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
internal-sftp in sshd in OpenSSH before 10.4 recognizes only the …
internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.
References
Affected products
OpenSSH
- <10.4
Matching in nixpkgs
pkgs.openssh
Implementation of the SSH protocol
pkgs.opensshTest
Implementation of the SSH protocol
pkgs.openssh_hpn
Implementation of the SSH protocol with high performance networking patches
pkgs.openssh_gssapi
Implementation of the SSH protocol with GSSAPI support
pkgs.openssh-askpass
A passphrase dialog for OpenSSH and GTK
pkgs.opensshWithKerberos
Implementation of the SSH protocol
pkgs.openssh_hpnWithKerberos
Implementation of the SSH protocol with high performance networking patches
pkgs.perlPackages.NetOpenSSH
Perl SSH client package implemented on top of OpenSSH
pkgs.perl5Packages.NetOpenSSH
Perl SSH client package implemented on top of OpenSSH
Package maintainers
-
@romildo José Romildo Malaquias <malaquias@gmail.com>
-
@numinit Morgan Jones <me+nixpkgs@numin.it>
-
@infinisil Silvan Mosberger <contact@infinisil.com>
-
@balsoft Alexander Bantyev <balsoft75@gmail.com>
-
@leona-ya Leona Maroni <nix@leona.is>
-
@philiptaron Philip Taron <philip.taron@gmail.com>
-
@andir Andreas Rammhold <andreas@rammhold.de>
-
@pyrox0 Pyrox <pyrox@pyrox.dev>
-
@dasJ Janne Heß <janne@hess.ooo>
-
@helsinki-Jo Joachim Ernst <joachim.ernst@helsinki-systems.de>
-
@n3tshift n3tshift <n3tshift@tilde.pink>
-
@wahjava Ashish SHUKLA <ashish.is@lostca.se>