CVE-2025-61984
Publication date 6 October 2025
Last updated 12 March 2026
Ubuntu priority
Description
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)
Read the notes from the security team
Why is this CVE low priority?
This issue is considered minor by OpenSSH developers
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| openssh | 25.10 questing |
Fixed 1:10.0p1-5ubuntu5.1
|
| 24.04 LTS noble |
Fixed 1:9.6p1-3ubuntu13.15
|
|
| 22.04 LTS jammy |
Fixed 1:8.9p1-3ubuntu0.14
|
|
| 20.04 LTS focal |
Fixed 1:8.2p1-4ubuntu0.13+esm1
|
|
| 18.04 LTS bionic |
Vulnerable
|
|
| 16.04 LTS xenial |
Vulnerable
|
|
| 14.04 LTS trusty |
Vulnerable
|
|
| openssh-ssh1 | 25.10 questing | Ignored |
| 24.04 LTS noble | Ignored | |
| 22.04 LTS jammy | Ignored | |
| 20.04 LTS focal | Ignored | |
| 18.04 LTS bionic | Ignored |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialNotes
mdeslaur
openssh-ssh1 is only provided for compatibility with old devices that cannot be upgraded to modern protocols. We will not be providing any security support for the openssh-ssh1 package as it is insecure and should be used in trusted environments only. This issue is considered "minor" by the OpenSSH developers. Also, it is not recommended to construct ssh commandlines from untrusted usernames and URLs. As such, setting priority as "low", this can be bundled in the next round of OpenSSH security updates. When fixing this, also include username validity checking added to 9.6.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
3.6 · Low
|
| Attack vector | Local |
| Attack complexity | High |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity impact | Low |
| Availability impact | None |
| Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-8090-1
- OpenSSH vulnerabilities
- 12 March 2026
- USN-8090-2
- OpenSSH vulnerabilities
- 12 March 2026