Updated OpenSSH packages are now available for Red Hat Linux 7, 7.1, and 7.2. These updates fix a bug in handling of restricted keys which may allow users to bypass command restrictions by using subsystems and a subtle bug which might aid a passive analysis attack.
OpenSSH versions prior to 2.9.9, when configured to provide sftp access using the subsystem feature, allows remote authenticated users to bypass authorized_keys2 "command=" restrictions by using sftp commands. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2001-0816 to this issue. OpenSSH 2.9 also contained a subtle bug in the routines which attempt to confound an attacker using passive analysis, which would cause it to send two confounding packets instead of one when a client finished sending it a password. Red Hat would like to thank Solar Designer and Markus Friedl for assisting with the patches.