CVE-2025-32728

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-32728
In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/013_ssh.patch.sig Product
https://github.com/openssh/openssh-portable/commit/fc86875e6acb36401dfc1dfb6b628a9d1460f367 Patch
https://lists.mindrot.org/pipermail/openssh-unix-dev/2025-April/041879.html Mailing List Product Release Notes
https://www.openssh.com/txt/release-10.0 Release Notes
https://www.openssh.com/txt/release-7.4 Release Notes
https://lists.debian.org/debian-lts-announce/2025/05/msg00008.html Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20250425-0002/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

22 May 2025, 16:51

Type Values Removed Values Added
References () https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/013_ssh.patch.sig - () https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/013_ssh.patch.sig - Product
References () https://github.com/openssh/openssh-portable/commit/fc86875e6acb36401dfc1dfb6b628a9d1460f367 - () https://github.com/openssh/openssh-portable/commit/fc86875e6acb36401dfc1dfb6b628a9d1460f367 - Patch
References () https://lists.mindrot.org/pipermail/openssh-unix-dev/2025-April/041879.html - () https://lists.mindrot.org/pipermail/openssh-unix-dev/2025-April/041879.html - Mailing List, Product, Release Notes
References () https://www.openssh.com/txt/release-10.0 - () https://www.openssh.com/txt/release-10.0 - Release Notes
References () https://www.openssh.com/txt/release-7.4 - () https://www.openssh.com/txt/release-7.4 - Release Notes
References () https://lists.debian.org/debian-lts-announce/2025/05/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/05/msg00008.html - Mailing List, Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20250425-0002/ - () https://security.netapp.com/advisory/ntap-20250425-0002/ - Third Party Advisory
CPE cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
First Time Debian debian Linux
Debian
Openbsd
Openbsd openssh
CWE NVD-CWE-noinfo

08 May 2025, 14:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/05/msg00008.html -

25 Apr 2025, 23:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20250425-0002/ -

11 Apr 2025, 15:40

Type Values Removed Values Added
Summary
  • (es) En sshd en OpenSSH anterior a 10.0, la directiva DisableForwarding no cumple con la documentación que indica que deshabilita el reenvío de X11 y del agente.

10 Apr 2025, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-10 02:15

Updated : 2025-05-22 16:51

NVD link : CVE-2025-32728

Mitre link : CVE-2025-32728

CVE.ORG link : CVE-2025-32728

JSON object : View

Products Affected

debian

  • debian_linux

openbsd

  • openssh
CWE
CWE-440

Expected Behavior Violation

NVD-CWE-noinfo