Updated openssh packages fix security vulnerabilities
Publication date: 14 Jan 2024Modification date: 14 Jan 2024
Type: security
Affected Mageia releases : 9
CVE: CVE-2023-38408 , CVE-2023-48795 , CVE-2023-51384 , CVE-2023-51385
Description
The updated packages fix security vulnerabilities: The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (CVE-2023-38408) Prefix Truncation Attacks in SSH Specification (Terrapin Attack). (CVE-2023-48795) In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys. (CVE-2023-51384) In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name. (CVE-2023-51385)
References
- https://bugs.mageia.org/show_bug.cgi?id=32704
- https://ubuntu.com/security/notices/USN-6565-1
- https://www.openwall.com/lists/oss-security/2023/12/18/3
- https://www.openwall.com/lists/oss-security/2023/12/19/5
- https://www.openwall.com/lists/oss-security/2023/12/20/3
- https://bugs.mageia.org/show_bug.cgi?id=31001
- https://www.openwall.com/lists/oss-security/2023/07/19/8
- https://www.openwall.com/lists/oss-security/2023/07/19/9
- https://www.openssh.com/txt/release-9.3p2
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38408
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51384
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51385
SRPMS
9/core
- openssh-9.3p1-2.1.mga9