Back Linuxsecurity

Fedora 43 OpenSSH Major Update Addressing Information Disclosure Issues

Linuxsecurity •LinuxSecurity Advisories • March 20, 2026

SSH (Secure SHell) is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forwarded over the secure channel. OpenSSH is OpenBSD's version of the last free version of SSH, bringing it up to date in terms of security and features. This package includes the core files necessary for both the OpenSSH client and server. To make this package useful, you should also install openssh-clients, openssh-server, or both. Update Information : CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex

SSH (Secure SHell) is a program for logging into and executing

commands on a remote machine. SSH is intended to replace rlogin and

rsh, and to provide secure encrypted communications between two

untrusted hosts over an insecure network. X11 connections and

arbitrary TCP/IP ports can also be forwarded over the secure channel.

OpenSSH is OpenBSD's version of the last free version of SSH, bringing

it up to date in terms of security and features.

This package includes the core files necessary for both the OpenSSH

client and server. To make this package useful, you should also

install openssh-clients, openssh-server, or both.

CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex

* Wed Mar 18 2026 Zoltan Fridrich - 10.0p1-7 - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: rhbz#2447290 - remove obsolete patch for ssh manual page Resolves: rhbz#2442505

[ 1 ] Bug #2442505 - 0043-openssh-8.7p1-ssh-manpage.patch introduces duplicates in documentation [ 2 ] Bug #2447289 - CVE-2026-3497 openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables [fedora-42] [ 3 ] Bug #2447290 - CVE-2026-3497 openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables [fedora-43]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-bab4aa5da7' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora OpenSSH Update Addresses CVE-2026-3497 Information Disclosure Vulnerability A major update for OpenSSH in Fedora 43 and an important fix for Fedora 42 were released to address CVE-2026-3497, which involves information disclosure or denial of service due to uninitialized variables in gssapi-keyex. The vulnerability affects both Fedora 42 and Fedora 43 systems, potentially allowing attackers to exploit the issue if not patched. The updates were published on March 18, 2026, and are available for installation via the 'dnf' update program. Users are advised to upgrade to the latest versions to mitigate the risks associated with this vulnerability. The specific versions affected include OpenSSH 10.0p1-7 for Fedora 43 and 9.9p1-13 for Fedora 42. The vulnerability was published on March 12, 2026, and is categorized as a medium severity issue. Both articles emphasize the importance of applying the updates promptly to ensure system security. 3 sources 57

Extracted Entities

Attack Types (2)

Data Breach DDoS

CVEs (1)

CVE-2026-3497