CLSA-2023-1703784959 openssh: Fix of CVE-2023-51385

CVE-2023-51385: ban user/hostnames with most shell metacharacters in command line...

Moderate Photon OS Security Update - PHSA-2023-5.0-0181

Updates of 'openssh' packages of Photon OS have been released...

Fedora 38 : podman-tui (2023-cb8c606fbb)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-cb8c606fbb advisory. release v0.15.0 includes security fix for CVE-2023-48795 Tenable has extracted the preceding description block directly from the Fedora security advisory. No...

Fedora 39 : podman-tui (2023-20feb865d8)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-20feb865d8 advisory. release v0.15.0 includes security fix for CVE-2023-48795 Tenable has extracted the preceding description block directly from the Fedora security advisory. No...

OpenSSH: Multiple Vulnerabilities

Background OpenSSH is a free application suite consisting of server and clients that replace tools like telnet, rlogin, rcp and ftp with more secure versions offering additional functionality. Description Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers...

GLSA-202312-16 : libssh: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202312-16 libssh: Multiple Vulnerabilities - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are...

GLSA-202312-17 : OpenSSH: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202312-17 OpenSSH: Multiple Vulnerabilities - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets ar...

CLSA-2023-1703612912 openssh: Fix of CVE-2023-51385

CVE-2023-51385: ban user/hostnames with most shell metacharacters in command line...

CLSA-2023-1703612727 openssh: Fix of CVE-2023-51385

CVE-2023-51385: ban user/hostnames with most shell metacharacters in command line...

CLSA-2023-1703612125 openssh: Fix of CVE-2023-51385

CVE-2023-51385: ban user/hostnames with most shell metacharacters in command line...

Exploit for OS Command Injection in Openbsd Openssh

CVE-2023-51385 poc OpenSSH ProxyCommand RCE poc OpenSSH...

[SECURITY] [DLA 3694-1] openssh security update

Debian LTS Advisory DLA-3694-1 [email protected] https://www.debian.org/lts/security/ Santiago Ruano Rincón December 25, 2023 https://wiki.debian.org/LTS Package : openssh Version : 1:7.9p1-10+deb10u4 CVE ID : CVE-2021-41617 CVE-2023-48795 CVE-2023-51385 Debian Bug : 995130 Several...

CVE-2023-51767

An authentication bypass vulnerability was found in OpenSSH. When common types of DRAM memory are used, it might allow row hammer attacks because the integer value of authenticated authpassword does not resist flips of a single bit. Mitigation Mitigation for this issue is either not available or...

In ssh in OpenSSH before 9.6 OS command injection might occur if a user name or host name has shell metacharacters and this name is referenced by an expansion token in certain situations. For example an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

...

In ssh-agent in OpenSSH before 9.6 certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys these constraints are only applied to the first key even if a PKCS#11 token returns multiple keys.

...

SUSE CVE-2023-51767

OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks for authentication bypass because the integer value of authenticated in mmanswerauthpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim...

Debian: Security Advisory (DSA-5586-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DLA-3694-1 openssh - security update

Bulletin has no description...

Improper Isolation or Compartmentalization

Overview Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization with the memory involved in the mmanswerauthpassword function. A co-located attacker with low privileges can escalate privileges by inducing bit flips through ROWHAMMER attacks on stack variabl...

CVE-2023-51767

OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks for authentication bypass because the integer value of authenticated in mmanswerauthpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim...