CVE-2025-32728
MEDIUM severity · CVSS 4.3 · CWE-440
4.3CVSS MEDIUM
Summary
In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.
Impact & exploitability
Attack vectorLocal
Attack complexityLow
Privileges requiredNone
User interactionNone
Confidentiality impactNone
Integrity impactLow
Availability impactNone
Exploit probability (EPSS)0%
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: https://github.com/openssh/openssh-portable/commit/fc86875e6acb36401dfc1dfb6b628a9d1460f367 ↗
Additional information
- NVD record
- https://github.com/openssh/openssh-portable/commit/fc86875e6acb36401dfc1dfb6b628a9d1460f367Patch
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/013_ssh.patch.sig
- https://lists.mindrot.org/pipermail/openssh-unix-dev/2025-April/041879.html
- https://www.openssh.com/txt/release-10.0
- https://www.openssh.com/txt/release-7.4
- https://lists.debian.org/debian-lts-announce/2025/05/msg00008.htmlAdvisory
- https://security.netapp.com/advisory/ntap-20250425-0002/Advisory