ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "openssh-client": "1:8.2p1-4ubuntu0.2", "ssh-askpass-gnome-dbgsym": "1:8.2p1-4ubuntu0.2", "openssh-tests": "1:8.2p1-4ubuntu0.2", "openssh-sftp-server-dbgsym": "1:8.2p1-4ubuntu0.2", "ssh-askpass-gnome": "1:8.2p1-4ubuntu0.2", "openssh-sftp-server": "1:8.2p1-4ubuntu0.2", "openssh-tests-dbgsym": "1:8.2p1-4ubuntu0.2", "openssh-server-udeb": "1:8.2p1-4ubuntu0.2", "openssh-server": "1:8.2p1-4ubuntu0.2", "openssh-server-dbgsym": "1:8.2p1-4ubuntu0.2", "openssh-client-udeb": "1:8.2p1-4ubuntu0.2", "ssh": "1:8.2p1-4ubuntu0.2", "openssh-client-dbgsym": "1:8.2p1-4ubuntu0.2" } ] }