OpenSSH Moderate Security Update
Summary
ALSA-2024:0606: Moderate: openssh security update. Affects openssh versions < 8.0p1-19.el8_9.2. Fixed in 8.0p1-19.el8_9.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is an SSH protocol implementation used by various Linux, UNIX, and similar operating systems. It provides the necessary files for both the OpenSSH client and server. OpenSSH allows secure remote access and file transfer between systems.
Vulnerability Detail
The OpenSSH security update addresses two vulnerabilities:
-
Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795): This vulnerability could be exploited by an attacker to perform a prefix truncation attack on the BPP, potentially leading to unauthorized access or information disclosure.
-
Potential command injection via shell metacharacters (CVE-2023-51385): This vulnerability allows an attacker to inject malicious commands using shell metacharacters, potentially leading to remote code execution or unauthorized access.
How To Fix
Minimum fixed version
8.0p1-19.el8_9.2
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The OpenSSH security update addresses two vulnerabilities that could potentially lead to unauthorized access, information disclosure, or remote code execution. It is crucial to update the OpenSSH package to the recommended version to mitigate these risks. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is an SSH protocol implementation used for secure remote access and file transfer between systems.
The prefix truncation attack vulnerability could allow an attacker to gain unauthorized access or disclose sensitive information.
The command injection vulnerability could allow an attacker to execute arbitrary commands or gain unauthorized access.
To fix the vulnerabilities, update the OpenSSH package to version 8.0p1-19.el8_9.2 or later.
No specific workaround has been provided for these vulnerabilities. It is recommended to update the OpenSSH package.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
