Medium: libssh

Issue Overview: AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A protocol extension has been introduced by OpenSSH which needs to be applied to both the client and the server in order to address this issue. We recommen...

Fedora 39 : podman (2024-3bb23c77f3)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-3bb23c77f3 advisory. Automatic update for podman-4.8.3-1.fc39. Changelog for podman Wed Jan 03 2024 Packit - 5:4.8.3-1 - packit 4.8.3 upstream release Tenable has extracted the...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-paramiko (SUSE-SU-2024:0035-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0035-1 advisory. - CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity aka Terrapin Attack bscbsc121816...

D3m0n1z3dShell - Demonized Shell Is An Advanced Tool For Persistence In Linux

Demonized Shell is an Advanced Tool for persistence in linux. Install git clone https://github.com/MatheuZSecurity/D3m0n1z3dShell.git cd D3m0n1z3dShell chmod +x demonizedshell.sh sudo ./demonizedshell.sh One-Liner Install Download D3m0n1z3dShell with all files: curl -L...

OESA-2024-1027 libssh security update

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote...

openSUSE 15 Security Update : proftpd (openSUSE-SU-2024:0008-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0008-1 advisory. - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass...

CVE-2023-48795 vulnerability on SSH

panel:title=Strict key exchange support|borderStyle=solid|borderColor=3c78b5|titleBGColor=3c78b5|bgColor=e7f4fa The server now supports strict key exchange in 8.9.10+ LTS, 8.13.6+, 8.14.5+, 8.15.4+, 8.16.3+, 8.17.1+ and 8.18.0+. If old SSH clients that don't support strict key exchange are being...

Server Side Request Forgery

github.com/gravitational/teleport is vulnerable to Server Side Request Forgery SSRF. The vulnerability is caused due to lack of proper validation or restrictions of the destinations for SSH connections initiated through the proxy or agents. This allows an authenticated user with valid credentials...

openSUSE 15 Security Update : putty (openSUSE-SU-2024:0005-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2024:0005-1 advisory. - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity...

USN-6565-1 openssh vulnerabilities

It was discovered that OpenSSH incorrectly handled supplemental groups when running helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand as a different user. An attacker could possibly use this issue to escalate privileges. This issue only affected Ubuntu 20.04 LTS...

OPENSUSE-SU-2024:0005-1 Security update for putty

This update for putty fixes the following issues: putty was updated to to release 0.80: Fix CVE-2023-48795 boo1218128 - Update to release 0.79 Terminal mouse tracking: support for mouse movements which are not drags, and support for horizontal scroll events e.g. generated by trackpads. Fixed: PuT...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : OpenSSH vulnerabilities (USN-6565-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6565-1 advisory. It was discovered that OpenSSH incorrectly handled supplemental groups when running helper programs for AuthorizedKeysCommand...

SUSE: Security Advisory (SUSE-SU-2024:0006-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libssh2_org (SUSE-SU-2024:0006-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0006-1 advisory. - CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity Terrapin Attack bsc1218127...

CVE-2022-3010

The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calculate the login credentials for the Priva TopControll suite...

Code injection

The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calculate the login credentials for the Priva TopControll suite...

CVE-2022-3010 Predictable SSH credentials in Priva TopControl Suite

The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calculate the login credentials for the Priva TopControll suite...

CVE-2022-3010 Predictable SSH credentials in Priva TopControl Suite

The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calculate the login credentials for the Priva TopControll suite...

CVE-2022-3010

Summary: CVE-2022-3010 affects Priva TopControl Suite versions prior to 8.7.8.0, where an SSH credential deciphering vulnerability exists due to insecure password hashing (CWE-916). This could allow an attacker to calculate and use login credentials to access the affected components remotely. Aff...

SUSE-SU-2024:0006-1 Security update for libssh2_org

This update for libssh2org fixes the following issues: - CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity Terrapin Attack bsc1218127...