CVE-2001-1380: OpenSSH before 2.9.9, while using keypairs and multiple keys of different types in the ~/.ssh/authorized_ke...

Security readout for executives and security teams

This issue affects very old OpenSSH versions before 2.9.9. When administrators used authorized_keys2 with multiple key types and source restrictions, OpenSSH could mishandle the from option, allowing a key to be accepted from an IP address that should have been blocked. Exposure is most plausible on legacy systems running OpenSSH before 2.9.9 that still use authorized_keys2 and from-based source restrictions. Modern maintained OpenSSH deployments are unlikely to be exposed, but old appliances, forgotten Unix/Linux hosts, or archived images should be checked. Treat this as a legacy exposure cleanup item, not a current mass-exploitation emergency based on the provided sources. Prioritize it where SSH is internet-accessible, tied to privileged accounts, or present on unsupported systems. Mitigation focus: Upgrade OpenSSH to 2.9.9 or a vendor-supported fixed package.; Prioritize externally reachable SSH services and high-privilege accounts.; Review authorized_keys2 files that rely on from source restrictions..

Prepared

Jun 30, 2026, 16:35 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.