In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
Weakness
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openssh | Openbsd | * | 10.5 (excluding) |
| Red Hat Enterprise Linux 10 | RedHat | openssh-0:9.9p1-27.el10_2 | * |
| Red Hat Enterprise Linux 9 | RedHat | openssh-0:9.9p1-11.el9_8 | * |
| Red Hat Enterprise Linux 9 | RedHat | openssh-0:9.9p1-11.el9_8 | * |
| Red Hat Hardened Images | RedHat | openssh-main-10.5p1-1.hum1 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/installer-rhel9:1790241922 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/rhua-rhel9:1790242004 | * |
| Openssh | Ubuntu | jammy | * |
| Openssh | Ubuntu | noble | * |
| Openssh | Ubuntu | resolute | * |
| Openssh-ssh1 | Ubuntu | devel | * |
| Openssh-ssh1 | Ubuntu | esm-apps/bionic | * |
| Openssh-ssh1 | Ubuntu | esm-apps/focal | * |
| Openssh-ssh1 | Ubuntu | esm-apps/jammy | * |
| Openssh-ssh1 | Ubuntu | esm-apps/noble | * |
| Openssh-ssh1 | Ubuntu | esm-apps/resolute | * |
| Openssh-ssh1 | Ubuntu | jammy | * |
| Openssh-ssh1 | Ubuntu | noble | * |
| Openssh-ssh1 | Ubuntu | resolute | * |
| Openssh-ssh1 | Ubuntu | upstream | * |