Bug#1132572: openssh: CVE-2026-35385

Salvatore Bonaccorso <[email protected]> Fri, 03 Apr 2026 10:54:48 +0200

Newsgroups	gmane.linux.debian.devel.ssh
Message-ID	<177520648826.221595.8424897380364220801.reportbug__36935.1934570418$1775206648$gmane$org@eldamar.lan>

Source: openssh
Version: 1:10.2p1-6
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerability was published for openssh.

CVE-2026-35385[0]:
| In OpenSSH before 10.3, a file downloaded by scp may be installed
| setuid or setgid, an outcome contrary to some users' expectations,
| if the download is performed as root with -O (legacy scp protocol)
| and without -p (preserve mode).


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-35385
    https://www.cve.org/CVERecord?id=CVE-2026-35385

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore