There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted
    across authentication attempts. (CVE-2026-106555)

AlmaLinux 9.2 主机上存在安装的程序包，该程序包受到 TuxCare ALMALINUX9.2：CLSA-2026：1792197391公告中提及的多个漏洞的影响。

  - 在之前 10.6OpenSSH 的 sftp 中，服务器可在递归复制操作期间触发目录遍历（导致将文件写入非预期位置）。（CVE-2026-106552）

  - 在 之前的 OpenSSH 10.6的 sshd 中，GSSAPIAuthentication 认证尝试失败后凭据会错误地保留。（CVE-2026-106553）

  - 在低于 10.6的 OpenSSH 的 sshd 中，GSSAPIAuthentication 认证状态可跨认证尝试错误地持续存在。（CVE-2026-106555）

  - 在之前 10.6LZ77 OpenSSH 的 sshd 和 ssh 中，可以使用字典编码器，即使 arXiv 2609.07709 Crossing the Streams 发现结果禁止这样做。（CVE-2026-106582）

  - 在 OpenSSH 之前 10.6的 ssh 中，命令行用户名内可能会出现 $ 或 \ 字符，导致注入。（CVE-2026-106583）

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

AlmaLinux 9.2 主機已安裝的套件會受到 TuxCare ALMALINUX9.2：CLSA-2026：1792197391 公告中提及的多個弱點影響。

  - 在之前 10.6OpenSSH 的 sftp 中，伺服器可以在遞迴複製作業期間觸發目錄遊走 （導致檔案寫入非預期位置）。（CVE-2026-106552）

  - 在之前 10.6OpenSSH 的 sshd 中，在 GSSAPIAuthentication 驗證嘗試失敗後，憑證可能會錯誤地保留。（CVE-2026-106553）

  - 在之前 10.6OpenSSH 的 sshd 中，GSSAPIAuthentication 驗證狀態可能會在驗證嘗試中錯誤地持續存在。（CVE-2026-106555）

  - 在之前 10.6LZ77 OpenSSH 的 sshd 和 ssh 中，可以使用字典編碼器，即使 arXiv 2609.07709 Crossing the Streams 發現項目禁止這樣做。（CVE-2026-106582）

  - 在 OpenSSH 之前 10.6的 ssh 中，命令列使用者名稱中可能會出現 $ 或 \ 字元，從而導致插入。（CVE-2026-106583）

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

AlmaLinux 9.2 ホストには、TuxCare ALMALINUX9.2:CLSA-2026:1792197391アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  - 10.6 より前の OpenSSH の sftp では、サーバーが、再帰コピー操作中にディレクトリトラバーサル(意図しない場所にファイルが書き込まれる)をトリガーする可能性があります。(CVE-2026-106552)

  - 10.6 以前の OpenSSH の sshd では、GSSAPIAuthentication 認証試行の失敗後、認証情報が不適切に保持される可能性があります。(CVE-2026-106553)

  - 10.6 より前の OpenSSH の sshd では、GSSAPIAuthentication 認証状態が認証試行間で不適切に持続する可能性があります。(CVE-2026-106555)

  - 10.6 より前の OpenSSH の sshd および ssh では、arXiv 2609.07709 Crossing the Streams の調査結果では禁忌であるにもかかわらず、LZ77 辞書コーダーを使用できます。(CVE-2026-106582)

  - 10.6 より前の OpenSSH の ssh では、コマンドラインのユーザー名に文字 $ または \ が現れ、インジェクションが発生する可能性があります。(CVE-2026-106583)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792197391 advisory.

  - In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to     unintended locations) during a recursive copy operation. (CVE-2026-106552)

  - In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a     GSSAPIAuthentication authentication attempt. (CVE-2026-106553)

  - In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted     across authentication attempts. (CVE-2026-106555)

  - In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is     contraindicated by the arXiv 2609.07709 Crossing the Streams findings. (CVE-2026-106582)

  - In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to     injection. (CVE-2026-106583)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8928-1 advisory.

    It was discovered that OpenSSH's sftp client incorrectly handled paths returned by the server during a     recursive copy operation. A remote attacker controlling the server could possibly use this issue to write     files to unintended locations. (CVE-2026-106552)

    It was discovered that OpenSSH's sshd server incorrectly handled GSSAPIAuthentication state across     authentication attempts. An attacker could possibly use this issue to obtain credentials from a previous     failed authentication attempt. (CVE-2026-106553, CVE-2026-106555)

    It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder during compression. An attacker     could possibly use this issue to obtain sensitive information. (CVE-2026-106582)

    It was discovered that OpenSSH's ssh client incorrectly allowed special characters in command-line     usernames. An attacker could possibly use this issue to inject arbitrary commands via specially crafted     usernames. (CVE-2026-106583)

    It was discovered that OpenSSH's ssh-keygen incorrectly handled Daylight Saving Time when converting     dates. An attacker could possibly use this issue to cause certificates to have incorrect expiration times.
    (CVE-2026-106584)

    It was discovered that OpenSSH did not check whether the maximum packet length was exceeded during     decompression. A remote attacker could possibly use this issue to cause a denial of service.
    (CVE-2026-106585)

    It was discovered that OpenSSH's sshd server incorrectly applied the restrict keyword from authorized_keys     to tunnel forwarding requests. A local attacker with an authorized key could possibly use this issue to     bypass intended tunnel forwarding restrictions. (CVE-2026-106586)

    It was discovered that OpenSSH's sshd server incorrectly handled certain configuration options that accept     a none value. An attacker could possibly use this issue to cause OpenSSH to behave unexpectedly.
    (CVE-2026-106587)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
473735	Echo: openssh: security update to 1:10.6p1-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	2026/10/8	2026/10/14	high
473735	Echo: openssh: security update to 1:10.6p1-1	Tenable Cloud Security	Echo Local Security Checks	2026/10/8	2026/10/14	high
366706	AlmaLinux 9.2 [TuxCare] 安全更新：openssh / openssh-askpass / openssh-clients / openssh-keycat / 等多个漏洞（ALMALINUX9.2：CLSA-2026：1792197391）	Nessus	Alma Linux Local Security Checks	2026/10/17	2026/10/17	high
366706	AlmaLinux 9.2 [TuxCare] 安全性更新：openssh / openssh-askpass / openssh-clients / openssh-keycat / etc 多個弱點（ALMALINUX9.2：CLSA-2026：1792197391）	Nessus	Alma Linux Local Security Checks	2026/10/17	2026/10/17	high
366706	AlmaLinux 9.2 [TuxCare] セキュリティ更新:openssh / openssh-askpass / openssh-clients / openssh-keycat / etcの複数の脆弱性(ALMALINUX9.2:CLSA-2026:1792197391)	Nessus	Alma Linux Local Security Checks	2026/10/17	2026/10/17	high
366706	AlmaLinux 9.2 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792197391)	Nessus	Alma Linux Local Security Checks	2026/10/17	2026/10/17	high
367205	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenSSH vulnerabilities (USN-8928-1)	Nessus	Ubuntu Local Security Checks	2026/10/19	2026/10/19	high

检测

插件搜索

high

high

high

high

high

high

high