CVE-2025-61985
Publication date 6 October 2025
Last updated 8 October 2025
Ubuntu priority
Description
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.
Read the notes from the security team
Why is this CVE low priority?
This issue is considered minor by OpenSSH developers
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| openssh | 25.04 plucky |
Needs evaluation
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty |
Needs evaluation
|
|
| openssh-ssh1 | 25.04 plucky | Ignored |
| 24.04 LTS noble | Ignored | |
| 22.04 LTS jammy | Ignored | |
| 20.04 LTS focal | Ignored | |
| 18.04 LTS bionic |
Needs evaluation
|
Notes
mdeslaur
openssh-ssh1 is only provided for compatibility with old devices that cannot be upgraded to modern protocols. We will not be providing any security support for the openssh-ssh1 package as it is insecure and should be used in trusted environments only. This issue is considered "minor" by the OpenSSH developers. Also, it is not recommended to construct ssh commandlines from untrusted usernames and URLs. As such, setting priority as "low", this can be bundled in the next round of OpenSSH security updates. When fixing this, also include username validity checking added to 9.6.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
3.6 · Low
|
| Attack vector | Local |
| Attack complexity | High |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity impact | Low |
| Availability impact | None |
| Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |