Astra Linux – Vulnerability in OpenSSH

A security regression CVE-2006-5051 was discovered in OpenSSH’s server sshd. There is a race condition that can cause sshd to handle certain signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger this condition by failing to authenticate within a specified time...

Security Bulletin: This Power System update is being released to address CVE-2023-48795

Summary This affects the BMC's secure shell SSH interfaces which provides service access to the BMC's command shell, access to the host console, and service access to the hypervisor console. The BMC does not have SSH extensions, so a successful attack will not downgrade client connection security...

XZ backdoor: Hook analysis

Part 1: XZ backdoor story – Initial analysis Part 2: Assessing the Y, and How, of the XZ Utils incident social engineering Part 3: XZ backdoor. Hook analysis In our first article on the XZ backdoor, we analyzed its code from initial infection to the function hooking it performs. As we mentioned...

PT-2024-6687 · Openssh +7 · Openssh +7

Name of the Vulnerable Software and Affected Versions: OpenSSH versions 9.5 through 9.7 Description: The issue is related to a logic error in the ObscureKeystrokeTiming function, which can lead to timing attacks against echo-off password entry, such as those used for su and Sudo. This could...

OpenSSH ECDSA Key Handler Unauthorized Access

The vulnerability of the OpenSSH ECDSA Key Handler component in JavaScript-based object signing and encryption technologies is related to the determination of the blacklist of prefixes for public keys. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to...

CLSA-2024-1718796706 openssh: Fix of CVE-2023-48795

CVE-2023-48795: implement "strict key exchange" in ssh and sshd...

CLSA-2024-1718791502 openssh: Fix of CVE-2023-48795

CVE-2023-48795: implement "strict key exchange" in ssh and sshd...

ROS-20240619-01

A vulnerability in the OpenSSH ECDSA Key Handler component of the OpenSSH ECDSA Key Handler technology for signing and encrypting JavaScript objects in Python is related to the definition of a blacklist of prefixes for public keys. Exploitation of the vulnerability could allow an attacker acting...

OPENSUSE-SU-2024:13517-1 openssh-9.3p2-5.1 on GA media

These are all security issues fixed in the openssh-9.3p2-5.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12983-1 openssh-9.3p1-1.1 on GA media

These are all security issues fixed in the openssh-9.3p1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10174-1 openssh-7.2p2-3.1 on GA media

These are all security issues fixed in the openssh-7.2p2-3.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13842-1 openssh-9.6p1-3.1 on GA media

These are all security issues fixed in the openssh-9.6p1-3.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13063-1 openssh-9.3p2-1.1 on GA media

These are all security issues fixed in the openssh-9.3p2-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11124-1 openssh-8.4p1-7.4 on GA media

These are all security issues fixed in the openssh-8.4p1-7.4 package on the GA media of openSUSE Tumbleweed...

HPESBNW04658 rev.1 - HPE Aruba AirWave Management Platform, Multiple OpenSSH Vulnerabilities

Potential Security Impact: Remote: Arbitrary Command Execution, Disclosure of Sensitive Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba AirWave Management Platform See Vulnerability summary Affected Products HPE Aruba Networking AirWave Management Platform 8.3.0....

ssh: Prefix truncation attack on Binary Packet Protocol (BPP)

A flaw was found in the SSH channel integrity. By manipulating sequence numbers during the handshake, an attacker can remove the initial messages on the secure channel without causing a MAC failure. For example, an attacker could disable the ping extension and thus disable the new countermeasure ...

RHEL 9 : openssh (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - openssh: Public key information leak CVE-2016-20012 - openssh: authentication bypass via row hammer attac...

RHEL 4 : openssh (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - openssh: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices CVE-2015-5600 - openssh: Bound...

RHEL 7 : openssh (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - openssh: scp allows command injection when using backtick characters in the destination argument...

RHEL 8 : openssh (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - openssh: User enumeration via malformed packets in authentication requests CVE-2018-15919 - openssh:...