==========================================================================
Ubuntu Security Notice USN-6560-2
January 11, 2024

openssh vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)

Summary:

Several security issues were fixed in OpenSSH.

Software Description:
- openssh: secure shell (SSH) for secure access to remote machines

Details:

USN-6560-1 fixed several vulnerabilities in OpenSSH. This update provides
the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

 Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH
 protocol was vulnerable to a prefix truncation attack. If a remote attacker
 was able to intercept SSH communications, extension negotiation messages
 could be truncated, possibly leading to certain algorithms and features
 being downgraded. This issue is known as the Terrapin attack. This update
 adds protocol extensions to mitigate this issue. (CVE-2023-48795)

 It was discovered that OpenSSH incorrectly handled user names or host names
 with shell metacharacters. An attacker could possibly use this issue to
 perform OS command injection. This only affected Ubuntu 18.04 LTS. (CVE-2023-51385)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
  openssh-client                  1:7.6p1-4ubuntu0.7+esm3
  openssh-server                  1:7.6p1-4ubuntu0.7+esm3

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
  openssh-client                  1:7.2p2-4ubuntu2.10+esm5
  openssh-server                  1:7.2p2-4ubuntu2.10+esm5

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-6560-2
  https://ubuntu.com/security/notices/USN-6560-1
  CVE-2023-48795, CVE-2023-51385

Ubuntu 6560-2: OpenSSH vulnerabilities

January 11, 2024
Several security issues were fixed in OpenSSH.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) Summary: Several security issues were fixed in OpenSSH. Software Description: - openssh: secure shell (SSH) for secure access to remote machines Details: USN-6560-1 fixed several vulnerabilities in OpenSSH. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension negotiation messages could be truncated, possibly leading to certain algorithms and features being downgraded. This issue is known as the Terrapin attack. This update adds protocol extensions to mitigate this issue. (CVE-2023-48795) It was discovered that OpenSSH incorrectly handled user names or host names with shell metacharacters. An attacker could possibly use this issue to perform OS command injection. This only affected Ubuntu 18.04 LTS. (CVE-2023-51385)

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS (Available with Ubuntu Pro): openssh-client 1:7.6p1-4ubuntu0.7+esm3 openssh-server 1:7.6p1-4ubuntu0.7+esm3 Ubuntu 16.04 LTS (Available with Ubuntu Pro): openssh-client 1:7.2p2-4ubuntu2.10+esm5 openssh-server 1:7.2p2-4ubuntu2.10+esm5 In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6560-2

https://ubuntu.com/security/notices/USN-6560-1

CVE-2023-48795, CVE-2023-51385

Severity
Ubuntu Security Notice USN-6560-2

Package Information

Related News

News

Powered By

Footer Logo

Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.

Powered By

Footer Logo