{
    "summary": {
        "snap": {
            "added": [],
            "removed": [],
            "diff": []
        },
        "deb": {
            "added": [],
            "removed": [],
            "diff": [
                "openssh-client",
                "openssh-server",
                "openssh-sftp-server"
            ]
        }
    },
    "diff": {
        "deb": [
            {
                "name": "openssh-client",
                "from_version": {
                    "source_package_name": "openssh",
                    "source_package_version": "1:8.9p1-3ubuntu0.15",
                    "version": "1:8.9p1-3ubuntu0.15"
                },
                "to_version": {
                    "source_package_name": "openssh",
                    "source_package_version": "1:8.9p1-3ubuntu0.16",
                    "version": "1:8.9p1-3ubuntu0.16"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-59995",
                        "url": "https://ubuntu.com/security/CVE-2026-59995",
                        "cve_description": "sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \"sftp server:/path .\" is used with an attacker-controlled server.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-59996",
                        "url": "https://ubuntu.com/security/CVE-2026-59996",
                        "cve_description": "scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-59997",
                        "url": "https://ubuntu.com/security/CVE-2026-59997",
                        "cve_description": "internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-59998",
                        "url": "https://ubuntu.com/security/CVE-2026-59998",
                        "cve_description": "sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-59999",
                        "url": "https://ubuntu.com/security/CVE-2026-59999",
                        "cve_description": "In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-60000",
                        "url": "https://ubuntu.com/security/CVE-2026-60000",
                        "cve_description": "sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-60001",
                        "url": "https://ubuntu.com/security/CVE-2026-60001",
                        "cve_description": "sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-60002",
                        "url": "https://ubuntu.com/security/CVE-2026-60002",
                        "cve_description": "ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-59995",
                                "url": "https://ubuntu.com/security/CVE-2026-59995",
                                "cve_description": "sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \"sftp server:/path .\" is used with an attacker-controlled server.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-59996",
                                "url": "https://ubuntu.com/security/CVE-2026-59996",
                                "cve_description": "scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-59997",
                                "url": "https://ubuntu.com/security/CVE-2026-59997",
                                "cve_description": "internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-59998",
                                "url": "https://ubuntu.com/security/CVE-2026-59998",
                                "cve_description": "sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-59999",
                                "url": "https://ubuntu.com/security/CVE-2026-59999",
                                "cve_description": "In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-60000",
                                "url": "https://ubuntu.com/security/CVE-2026-60000",
                                "cve_description": "sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-60001",
                                "url": "https://ubuntu.com/security/CVE-2026-60001",
                                "cve_description": "sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-60002",
                                "url": "https://ubuntu.com/security/CVE-2026-60002",
                                "cve_description": "ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: sftp downloaded files location issue",
                            "    - debian/patches/CVE-2026-59995.patch: upstream: avoid download to server-",
                            "      controlled path when performing in sftp.c.",
                            "    - CVE-2026-59995",
                            "  * SECURITY UPDATE: scp parent directory issue",
                            "    - debian/patches/CVE-2026-59996.patch: upstream: resist that return \"..\" via",
                            "      remote glob during in scp.c.",
                            "    - CVE-2026-59996",
                            "  * SECURITY UPDATE: internal-sftp ignores more than 9 commandline args",
                            "    - debian/patches/CVE-2026-59997.patch: upstream: pass >9 commandline",
                            "      arguments to the internal-sftp server, in session.c.",
                            "    - CVE-2026-59997",
                            "  * SECURITY UPDATE: undocumented GSSAPIStrictAcceptorCheck behaviour",
                            "    - debian/patches/CVE-2026-59998.patch: upstream: mention a caveat regarding",
                            "      GSSAPIStrictAcceptorCheck in in sshd_config.5.",
                            "    - CVE-2026-59998",
                            "  * SECURITY UPDATE: DisableForwarding=yes not taking proper precedence",
                            "    - debian/patches/CVE-2026-59999.patch: upstream: DisableForwarding=yes",
                            "      didn't override PermitTunnel=yes in serverloop.c.",
                            "    - CVE-2026-59999",
                            "  * SECURITY UPDATE: DoS via MaxAuthTries mishandling",
                            "    - debian/patches/CVE-2026-60000-1.patch: upstream: Fix multiple RFC 4462",
                            "      (GSSAPIAuthentication) compliance in auth2-gss.c.",
                            "    - debian/patches/CVE-2026-60000-2.patch: upstream: unused variables in",
                            "      auth2-gss.c.",
                            "    - CVE-2026-60000",
                            "  * SECURITY UPDATE: minimum authentication delay not always honoured",
                            "    - debian/patches/CVE-2026-60001.patch: upstream: Fix cases in GSSAPI and",
                            "      keyboard-interactive in auth.h, auth2-chall.c, auth2-gss.c, auth2.c.",
                            "    - CVE-2026-60001",
                            "  * SECURITY UPDATE: Use-after-free during a key re-exchange",
                            "    - debian/patches/CVE-2026-60002.patch: upstream: fix ownership and lifetime",
                            "      of several bits of client in ssh.c, sshconnect.c, sshconnect.h,",
                            "      sshconnect2.c.",
                            "    - CVE-2026-60002",
                            ""
                        ],
                        "package": "openssh",
                        "version": "1:8.9p1-3ubuntu0.16",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Thu, 09 Jul 2026 14:38:00 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "openssh-server",
                "from_version": {
                    "source_package_name": "openssh",
                    "source_package_version": "1:8.9p1-3ubuntu0.15",
                    "version": "1:8.9p1-3ubuntu0.15"
                },
                "to_version": {
                    "source_package_name": "openssh",
                    "source_package_version": "1:8.9p1-3ubuntu0.16",
                    "version": "1:8.9p1-3ubuntu0.16"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-59995",
                        "url": "https://ubuntu.com/security/CVE-2026-59995",
                        "cve_description": "sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \"sftp server:/path .\" is used with an attacker-controlled server.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-59996",
                        "url": "https://ubuntu.com/security/CVE-2026-59996",
                        "cve_description": "scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-59997",
                        "url": "https://ubuntu.com/security/CVE-2026-59997",
                        "cve_description": "internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-59998",
                        "url": "https://ubuntu.com/security/CVE-2026-59998",
                        "cve_description": "sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-59999",
                        "url": "https://ubuntu.com/security/CVE-2026-59999",
                        "cve_description": "In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-60000",
                        "url": "https://ubuntu.com/security/CVE-2026-60000",
                        "cve_description": "sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-60001",
                        "url": "https://ubuntu.com/security/CVE-2026-60001",
                        "cve_description": "sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-60002",
                        "url": "https://ubuntu.com/security/CVE-2026-60002",
                        "cve_description": "ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-59995",
                                "url": "https://ubuntu.com/security/CVE-2026-59995",
                                "cve_description": "sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \"sftp server:/path .\" is used with an attacker-controlled server.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-59996",
                                "url": "https://ubuntu.com/security/CVE-2026-59996",
                                "cve_description": "scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-59997",
                                "url": "https://ubuntu.com/security/CVE-2026-59997",
                                "cve_description": "internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-59998",
                                "url": "https://ubuntu.com/security/CVE-2026-59998",
                                "cve_description": "sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-59999",
                                "url": "https://ubuntu.com/security/CVE-2026-59999",
                                "cve_description": "In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-60000",
                                "url": "https://ubuntu.com/security/CVE-2026-60000",
                                "cve_description": "sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-60001",
                                "url": "https://ubuntu.com/security/CVE-2026-60001",
                                "cve_description": "sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-60002",
                                "url": "https://ubuntu.com/security/CVE-2026-60002",
                                "cve_description": "ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: sftp downloaded files location issue",
                            "    - debian/patches/CVE-2026-59995.patch: upstream: avoid download to server-",
                            "      controlled path when performing in sftp.c.",
                            "    - CVE-2026-59995",
                            "  * SECURITY UPDATE: scp parent directory issue",
                            "    - debian/patches/CVE-2026-59996.patch: upstream: resist that return \"..\" via",
                            "      remote glob during in scp.c.",
                            "    - CVE-2026-59996",
                            "  * SECURITY UPDATE: internal-sftp ignores more than 9 commandline args",
                            "    - debian/patches/CVE-2026-59997.patch: upstream: pass >9 commandline",
                            "      arguments to the internal-sftp server, in session.c.",
                            "    - CVE-2026-59997",
                            "  * SECURITY UPDATE: undocumented GSSAPIStrictAcceptorCheck behaviour",
                            "    - debian/patches/CVE-2026-59998.patch: upstream: mention a caveat regarding",
                            "      GSSAPIStrictAcceptorCheck in in sshd_config.5.",
                            "    - CVE-2026-59998",
                            "  * SECURITY UPDATE: DisableForwarding=yes not taking proper precedence",
                            "    - debian/patches/CVE-2026-59999.patch: upstream: DisableForwarding=yes",
                            "      didn't override PermitTunnel=yes in serverloop.c.",
                            "    - CVE-2026-59999",
                            "  * SECURITY UPDATE: DoS via MaxAuthTries mishandling",
                            "    - debian/patches/CVE-2026-60000-1.patch: upstream: Fix multiple RFC 4462",
                            "      (GSSAPIAuthentication) compliance in auth2-gss.c.",
                            "    - debian/patches/CVE-2026-60000-2.patch: upstream: unused variables in",
                            "      auth2-gss.c.",
                            "    - CVE-2026-60000",
                            "  * SECURITY UPDATE: minimum authentication delay not always honoured",
                            "    - debian/patches/CVE-2026-60001.patch: upstream: Fix cases in GSSAPI and",
                            "      keyboard-interactive in auth.h, auth2-chall.c, auth2-gss.c, auth2.c.",
                            "    - CVE-2026-60001",
                            "  * SECURITY UPDATE: Use-after-free during a key re-exchange",
                            "    - debian/patches/CVE-2026-60002.patch: upstream: fix ownership and lifetime",
                            "      of several bits of client in ssh.c, sshconnect.c, sshconnect.h,",
                            "      sshconnect2.c.",
                            "    - CVE-2026-60002",
                            ""
                        ],
                        "package": "openssh",
                        "version": "1:8.9p1-3ubuntu0.16",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Thu, 09 Jul 2026 14:38:00 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "openssh-sftp-server",
                "from_version": {
                    "source_package_name": "openssh",
                    "source_package_version": "1:8.9p1-3ubuntu0.15",
                    "version": "1:8.9p1-3ubuntu0.15"
                },
                "to_version": {
                    "source_package_name": "openssh",
                    "source_package_version": "1:8.9p1-3ubuntu0.16",
                    "version": "1:8.9p1-3ubuntu0.16"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-59995",
                        "url": "https://ubuntu.com/security/CVE-2026-59995",
                        "cve_description": "sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \"sftp server:/path .\" is used with an attacker-controlled server.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-59996",
                        "url": "https://ubuntu.com/security/CVE-2026-59996",
                        "cve_description": "scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-59997",
                        "url": "https://ubuntu.com/security/CVE-2026-59997",
                        "cve_description": "internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-59998",
                        "url": "https://ubuntu.com/security/CVE-2026-59998",
                        "cve_description": "sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-59999",
                        "url": "https://ubuntu.com/security/CVE-2026-59999",
                        "cve_description": "In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-60000",
                        "url": "https://ubuntu.com/security/CVE-2026-60000",
                        "cve_description": "sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-60001",
                        "url": "https://ubuntu.com/security/CVE-2026-60001",
                        "cve_description": "sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-60002",
                        "url": "https://ubuntu.com/security/CVE-2026-60002",
                        "cve_description": "ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-08 01:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-59995",
                                "url": "https://ubuntu.com/security/CVE-2026-59995",
                                "cve_description": "sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \"sftp server:/path .\" is used with an attacker-controlled server.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-59996",
                                "url": "https://ubuntu.com/security/CVE-2026-59996",
                                "cve_description": "scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-59997",
                                "url": "https://ubuntu.com/security/CVE-2026-59997",
                                "cve_description": "internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-59998",
                                "url": "https://ubuntu.com/security/CVE-2026-59998",
                                "cve_description": "sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-59999",
                                "url": "https://ubuntu.com/security/CVE-2026-59999",
                                "cve_description": "In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-60000",
                                "url": "https://ubuntu.com/security/CVE-2026-60000",
                                "cve_description": "sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-60001",
                                "url": "https://ubuntu.com/security/CVE-2026-60001",
                                "cve_description": "sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-60002",
                                "url": "https://ubuntu.com/security/CVE-2026-60002",
                                "cve_description": "ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-08 01:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: sftp downloaded files location issue",
                            "    - debian/patches/CVE-2026-59995.patch: upstream: avoid download to server-",
                            "      controlled path when performing in sftp.c.",
                            "    - CVE-2026-59995",
                            "  * SECURITY UPDATE: scp parent directory issue",
                            "    - debian/patches/CVE-2026-59996.patch: upstream: resist that return \"..\" via",
                            "      remote glob during in scp.c.",
                            "    - CVE-2026-59996",
                            "  * SECURITY UPDATE: internal-sftp ignores more than 9 commandline args",
                            "    - debian/patches/CVE-2026-59997.patch: upstream: pass >9 commandline",
                            "      arguments to the internal-sftp server, in session.c.",
                            "    - CVE-2026-59997",
                            "  * SECURITY UPDATE: undocumented GSSAPIStrictAcceptorCheck behaviour",
                            "    - debian/patches/CVE-2026-59998.patch: upstream: mention a caveat regarding",
                            "      GSSAPIStrictAcceptorCheck in in sshd_config.5.",
                            "    - CVE-2026-59998",
                            "  * SECURITY UPDATE: DisableForwarding=yes not taking proper precedence",
                            "    - debian/patches/CVE-2026-59999.patch: upstream: DisableForwarding=yes",
                            "      didn't override PermitTunnel=yes in serverloop.c.",
                            "    - CVE-2026-59999",
                            "  * SECURITY UPDATE: DoS via MaxAuthTries mishandling",
                            "    - debian/patches/CVE-2026-60000-1.patch: upstream: Fix multiple RFC 4462",
                            "      (GSSAPIAuthentication) compliance in auth2-gss.c.",
                            "    - debian/patches/CVE-2026-60000-2.patch: upstream: unused variables in",
                            "      auth2-gss.c.",
                            "    - CVE-2026-60000",
                            "  * SECURITY UPDATE: minimum authentication delay not always honoured",
                            "    - debian/patches/CVE-2026-60001.patch: upstream: Fix cases in GSSAPI and",
                            "      keyboard-interactive in auth.h, auth2-chall.c, auth2-gss.c, auth2.c.",
                            "    - CVE-2026-60001",
                            "  * SECURITY UPDATE: Use-after-free during a key re-exchange",
                            "    - debian/patches/CVE-2026-60002.patch: upstream: fix ownership and lifetime",
                            "      of several bits of client in ssh.c, sshconnect.c, sshconnect.h,",
                            "      sshconnect2.c.",
                            "    - CVE-2026-60002",
                            ""
                        ],
                        "package": "openssh",
                        "version": "1:8.9p1-3ubuntu0.16",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Thu, 09 Jul 2026 14:38:00 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "added": {
        "deb": [],
        "snap": []
    },
    "removed": {
        "deb": [],
        "snap": []
    },
    "notes": "Changelog diff for Ubuntu 22.04 jammy image from daily image serial 20260709 to 20260713",
    "from_series": "jammy",
    "to_series": "jammy",
    "from_serial": "20260709",
    "to_serial": "20260713",
    "from_manifest_filename": "daily_manifest.previous",
    "to_manifest_filename": "manifest.current"
}