Session Handling Vulnerability in OVH's Bastion for SSH Access Management

CVE-2025-59339

What is CVE-2025-59339?

The Bastion tool by OVH is responsible for managing SSH accesses with capabilities such as authentication, authorization, and audit logging. It includes a session recording feature, which generates ttyrec files. However, a flaw exists in the handling of these files when utilizing the osh-encrypt-rsync script. While the script is designed to rotate and encrypt session files using specified GPG keys, it fails to sign these files, compromising the integrity of the session recordings. This oversight could potentially lead to unauthorized manipulation of recorded sessions, making it critical for users to reassess their security configurations and ensure proper access control measures are in place.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References