Skip to main content
CVE-2025-22869VulnerabilityPublished Updated

SUSE · Security update for amazon-ssm-agent

Affects SUSESource GCVE Database

0
Compare

Mentioned vulnerabilities

Not known to be exploited · fixed in SUSE package updates : patch SUSE soon.

Data as of 10 Nov 2026, 20:06 UTC

Severity
High

Rated by Threat Radar · No CVSS score from NVD or the CNA

Patch
Available – fixed in 3.3.4624.0

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 17 Jun 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.

Description

This update for amazon-ssm-agent fixes the following issues Update to version 3.3.4624.0: - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239342). - CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702). - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611). - CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs (bsc#1265474). - CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258095). - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege esca (bsc#1266781). - CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264952). - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267332). - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200). - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200). - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200). - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266200). - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266200). - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266200). - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200). - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200). - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200). - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266200). - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266200). - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200). - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200). Changes: * Bump golang.org/x/crypto from v0.51.0 to v0.52.0 * Bump golang.org/x/net from v0.54.0 to v0.55.0 * Enforce directory boundary in BuildSafePath * Fix visibility issue with Bottlerocket OS in document output * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740) * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821) * Quit if sysprep failed and log its current state * Remove attached legacy cloudwatch plugin packages * Upgrade Go version to 1.25.10 * Use BuildSafePath wherever it is applicable * Add OOM killer protection to systemd service files * Apply more sanitation to file and registry inventory gatherers * Bump go-git to v5.17.1 * Deprecate legacy cloudwatch plugin * Preserve network error details in credential refresher SSM API failures * Upgrade Go version to 1.25.9 * Add SSM Distributor support for Bottlerocket OS * Implement flush credentials command in ssm-cli * Log ec2messages access denied as debug instead of error to reduce log noise * Make credential refresher refresh cache quickly in case of credential flush * Make Greengrass component registration resilient with retry * Add EnforceWorkspaceRootOwnership configuration to support disable hardening of agent workspace * Add reboot comment to Windows shutdown command for SSM Agent traceability * Update privilege access check to verify ownership and permissions of document state files * Add read-only version check prior to install and uninstall in case of occupied package manager locks * Add ANSI processing for CloudWatch and S3 log * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3 to fix CVE-2026-1229 - Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843) * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding cgroup file descriptors open * Upgrade Go version to 1.25.8 * Document CommandWorkerBufferLimit config * Include package update in Dockerfile * Reduce CloudWatch event message length threshold * Upgrade Go version to 1.25.7 * Update github.com/go-git/go-

References

Community reviews

Loading reviews…