Fedora 27: openssh Security Update
Summary
SSH (Secure SHell) is a program for logging into and executing
commands on a remote machine. SSH is intended to replace rlogin and
rsh, and to provide secure encrypted communications between two
untrusted hosts over an insecure network. X11 connections and
arbitrary TCP/IP ports can also be forwarded over the secure channel.
OpenSSH is OpenBSD's version of the last free version of SSH, bringing
it up to date in terms of security and features.
This package includes the core files necessary for both the OpenSSH
client and server. To make this package useful, you should also
install openssh-clients, openssh-server, or both.
Security fix for CVE-2018-15473
* Sat Aug 25 2018 Jakub Jelen
- Fix CVE-2018-15473 (#1619064)
* Thu Feb 1 2018 Jakub Jelen
- Build correctly against systemd
* Thu Feb 1 2018 Jakub Jelen
- Whitelist gettid() syscall in seccomp filter (#1524392)
- Do not pass hostnames to audit -- UseDNS is usually disabled (#1534577)
- Rework audit events to match requirements
- Packaging details from rawhide
* Mon Dec 11 2017 Jakub Jelen
- Do not segfault during audit cleanup (#1524233)
- Avoid gcc warnings about uninitialized variables
* Wed Nov 22 2017 Jakub Jelen
- Do not build everything against libldap
- Do not segfault for ECC keys in PKCS#11
* Thu Oct 19 2017 Jakub Jelen
- New upstream release OpenSSH 7.6
- Addressing review remarks for OpenSSL 1.1.0 patch
- Fix PermitOpen bug in OpenSSH 7.6
- Drop support for ExposeAuthenticationMethods option
* Mon Sep 11 2017 Jakub Jelen
- Do not export KRBCCNAME if the default path is used (#1199363)
- Add enablement for openssl-ibmca and openssl-ibmpkcs11 (#1477636)
- Add new GSSAPI kex algorithms with SHA-2, but leave them disabled for now
- Enforce pam_sepermit for all logins in SSH (#1492313)
- Remove pam_reauthorize, since it is not needed by cockpit anymore (#1492313)
[ 1 ] Bug #1619063 - CVE-2018-15473 openssh: User enumeration via malformed packets in authentication requests
https://bugzilla.redhat.com/show_bug.cgi?id=1619063
su -c 'dnf upgrade --advisory FEDORA-2018-f56ded11c4' at the command
line. For more information, refer to the dnf documentation available at
https://dnf.readthedocs.io/en/latest/command_ref.html
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/
FEDORA-2018-f56ded11c4 2018-09-13 17:05:57.362418 Product : Fedora 27 Version : 7.6p1 Release : 6.fc27 URL : http://www.openssh.com/portable.html Summary : An open source implementation of SSH protocol version 2 Description : SSH (Secure SHell) is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forwarded over the secure channel. OpenSSH is OpenBSD's version of the last free version of SSH, bringing it up to date in terms of security and features. This package includes the core files necessary for both the OpenSSH client and server. To make this package useful, you should also install openssh-clients, openssh-server, or both. Security fix for CVE-2018-15473 * Sat Aug 25 2018 Jakub Jelen - 7.6p1-6 + 0.10.3-3 - Fix CVE-2018-15473 (#1619064) * Thu Feb 1 2018 Jakub Jelen - 7.6p1-5 + 0.10.3-3 - Build correctly against systemd * Thu Feb 1 2018 Jakub Jelen - 7.6p1-4 + 0.10.3-3 - Whitelist gettid() syscall in seccomp filter (#1524392) - Do not pass hostnames to audit -- UseDNS is usually disabled (#1534577) - Rework audit events to match requirements - Packaging details from rawhide * Mon Dec 11 2017 Jakub Jelen - 7.6p1-3 + 0.10.3-3 - Do not segfault during audit cleanup (#1524233) - Avoid gcc warnings about uninitialized variables * Wed Nov 22 2017 Jakub Jelen - 7.6p1-2 + 0.10.3-3 - Do not build everything against libldap - Do not segfault for ECC keys in PKCS#11 * Thu Oct 19 2017 Jakub Jelen - 7.6p1-1 + 0.10.3-3 - New upstream release OpenSSH 7.6 - Addressing review remarks for OpenSSL 1.1.0 patch - Fix PermitOpen bug in OpenSSH 7.6 - Drop support for ExposeAuthenticationMethods option * Mon Sep 11 2017 Jakub Jelen - 7.5p1-6 + 0.10.3-2 - Do not export KRBCCNAME if the default path is used (#1199363) - Add enablement for openssl-ibmca and openssl-ibmpkcs11 (#1477636) - Add new GSSAPI kex algorithms with SHA-2, but leave them disabled for now - Enforce pam_sepermit for all logins in SSH (#1492313) - Remove pam_reauthorize, since it is not needed by cockpit anymore (#1492313) [ 1 ] Bug #1619063 - CVE-2018-15473 openssh: User enumeration via malformed packets in authentication requests https://bugzilla.redhat.com/show_bug.cgi?id=1619063 su -c 'dnf upgrade --advisory FEDORA-2018-f56ded11c4' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/
Change Log
References
Update Instructions
