Detections
Analytics

Echo: openssh: security update to 1:10.2p1-6

medium Tenable Cloud Security Plugin ID 457583

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability
 affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream
 project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows
 an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which
 will call the underlying function and continue the execution of the program without setting the related
 connection variables. As the variables are not initialized to NULL the code later accesses those
 uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended
 workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the
 vulnerability depends heavily on the compiler flag hardening configuration. (CVE-2026-3497)

Solution

Update the openssh library and its related packages to version 1:10.2p1-6 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-3497

Plugin Details

Severity: Medium

ID: 457583

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.63

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-3497

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/13/2026

Vulnerability Publication Date: 3/12/2026

Reference Information

CVE: CVE-2026-3497