Back Linuxsecurity

Oracle Linux 10 ELSA-2025

Linuxsecurity •LinuxSecurity Advisories • December 20, 2025

[9.9p1-12.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37824421] [9.9p1-12] - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-128397 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-128387

openssh-9.9p1-12.0.1.el10_1.x86_64.rpm openssh-askpass-9.9p1-12.0.1.el10_1.x86_64.rpm openssh-clients-9.9p1-12.0.1.el10_1.x86_64.rpm openssh-keycat-9.9p1-12.0.1.el10_1.x86_64.rpm openssh-keysign-9.9p1-12.0.1.el10_1.x86_64.rpm openssh-server-9.9p1-12.0.1.el10_1.x86_64.rpm

openssh-9.9p1-12.0.1.el10_1.aarch64.rpm openssh-askpass-9.9p1-12.0.1.el10_1.aarch64.rpm openssh-clients-9.9p1-12.0.1.el10_1.aarch64.rpm openssh-keycat-9.9p1-12.0.1.el10_1.aarch64.rpm openssh-keysign-9.9p1-12.0.1.el10_1.aarch64.rpm openssh-server-9.9p1-12.0.1.el10_1.aarch64.rpm

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle Linux Security Updates Address SSH Vulnerabilities Oracle has released security updates for Oracle Linux 10 and Oracle Linux 9 to address vulnerabilities in the SSH component. The updates include fixes for CVE-2025-61984, which rejects usernames with control characters, and CVE-2025-61985, which rejects URL-strings with NULL characters, affecting users of both versions. 2 sources 23

Extracted Entities

CVEs (2)

CVE-2025-61984 CVE-2025-61985

Platforms (2)

OpenSSH Oracle Linux