CVE-2026-39828
EUVD-2026-3139422.05.2026, 04:16
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| golang | crypto | 𝑥 < 0.52.0 |
𝑥
= Vulnerable software versions
Debian Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| amazon-ssm-agent |
| ||||||||||||||||
| apptainer |
| ||||||||||||||||
| apptainer-sle15_6 |
| ||||||||||||||||
| buildah |
| ||||||||||||||||
| google-guest-agent |
| ||||||||||||||||
| google-osconfig-agent |
|
Amazon Linux Releases
Amazon Package | |||||
|---|---|---|---|---|---|
| containerd |
| ||||
| containerd-debuginfo |
| ||||
| containerd-debugsource |
| ||||
| containerd-stress |
| ||||
| containerd-stress-debuginfo |
| ||||
| nerdctl |
| ||||
| nerdctl-debuginfo |
| ||||
| rclone |
| ||||
| rclone-debuginfo |
| ||||
| rclone-debugsource |
| ||||
| runfinch-finch |
|
Azure Linux Releases
Common Weakness Enumeration
- CWE-295 - Improper Certificate ValidationThe software does not validate, or incorrectly validates, a certificate.
- CWE-281 - Improper Preservation of PermissionsThe software does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Vulnerability Media Exposure
References