[slackware-security] libssh

New libssh packages are available for Slackware 14.2, 15.0, and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/libssh-0.10.6-i586-1slack15.0.txz: Upgraded. This update fixes security issues: Command injection using proxycommand. Potential...

USN-6560-1: OpenSSH vulnerabilities

Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension negotiation messages could be truncated, possibly leading to certain algorithms and features being...

SUSE-SU-2023:4905-1 Security update for openssh

This update for openssh fixes the following issues: - CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity bsc1217950...

SUSE-SU-2023:4903-1 Security update for openssh

This update for openssh fixes the following issues: - CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity bsc1217950...

SUSE CVE-2023-48795

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : libssh vulnerability (USN-6561-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6561-1 advisory. Fabian Bumer, Marcus Brinkmann, Jrg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote...

Medium: openssh

Issue Overview: AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A protocol extension has been introduced by OpenSSH which needs to be applied to both the client and the server in order to address this issue. We recommen...

AZL-32280 CVE-2023-48795 affecting package moby-engine for versions less than 20.10.27-1

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

AZL-32221 CVE-2023-48795 affecting package kubernetes for versions less than 1.28.4-4

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

CVE-2023-48795 vulnerabilities

Vulnerabilities for packages: libssh, trillian-fips, temporal-server, trivy, zot, tigera-operator, prometheus-stackdriver-exporter, metrics-server-fips, flux-kustomize-controller, crossplane-provider-azure-managedidentity, nerdctl, scorecard, crossplane-provider-azure-storage, kubeflow,...

AZL-32201 CVE-2023-48795 affecting package libssh2 for versions less than 1.9.0-4

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

AZL-45303 CVE-2023-48795 affecting package podman for versions less than 5.6.1-2

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

AZL-61246 CVE-2023-48795 affecting package rust for versions less than 1.90.0-1

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

AZL-36983 CVE-2023-48795 affecting package python-paramiko 2.12.0-2

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

AZL-34673 CVE-2023-48795 affecting package erlang for versions less than 26.2.3-1

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

CVE-2023-48795 vulnerabilities

Vulnerabilities for packages: cosign, memcached-exporter, go-licenses, spark-operator, kubeflow, cadvisor, k8sgpt, apko, src-fingerprint, kubeflow-pipelines, nerdctl, temporal-ui-server, falcoctl, skopeo, kyverno-policy-reporter, cfssl, crossplane-provider-azure-authorization,...

AZL-32200 CVE-2023-48795 affecting package libssh for versions less than 0.10.6-1

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

AZL-43951 CVE-2023-48795 affecting package podman 4.1.1-26

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

CVE-2023-48795

creationtimestamp| type| source ---|---|--- 2023-12-18 15:14:35+00:00| published-proof-of-concept| https://github.com/Eugeny/russh/security/advisories/GHSA-45x7-px36-x8w8 2023-12-18 16:16:12+00:00| published-proof-of-concept| https://github.com/ronf/asyncssh/security/advisories/GHSA-hfmc-7525-mj5...

Medium: openssh

Issue Overview: AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A protocol extension has been introduced by OpenSSH which needs to be applied to both the client and the server in order to address this issue. We recommen...