[USN-6560-2] OpenSSH vulnerabilities

[Leonidas S. Barbosa]

==========================================================================
Ubuntu Security Notice USN-6560-2
January 11, 2024

openssh vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)

Summary:

Several security issues were fixed in OpenSSH.

Software Description:
- openssh: secure shell (SSH) for secure access to remote machines

Details:

USN-6560-1 fixed several vulnerabilities in OpenSSH. This update provides
the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

 Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH
 protocol was vulnerable to a prefix truncation attack. If a remote attacker
 was able to intercept SSH communications, extension negotiation messages
 could be truncated, possibly leading to certain algorithms and features
 being downgraded. This issue is known as the Terrapin attack. This update
 adds protocol extensions to mitigate this issue. (CVE-2023-48795)

 It was discovered that OpenSSH incorrectly handled user names or host names
 with shell metacharacters. An attacker could possibly use this issue to
 perform OS command injection. This only affected Ubuntu 18.04 LTS. (CVE-2023-51385)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
  openssh-client                  1:7.6p1-4ubuntu0.7+esm3
  openssh-server                  1:7.6p1-4ubuntu0.7+esm3

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
  openssh-client                  1:7.2p2-4ubuntu2.10+esm5
  openssh-server                  1:7.2p2-4ubuntu2.10+esm5

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-6560-2
  https://ubuntu.com/security/notices/USN-6560-1
  CVE-2023-48795, CVE-2023-51385

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20240111/62751f88/attachment.sig>