Debian and Ubuntu release patch to fix OpenSSH vulnerabilities
Take action: If you are using Debian or Ubuntu, update your OpenSSH in a planned process. It shouldn't be a breaking change, but test out the upgrade on one system.
Learn More
Debian and Ubuntu have updated their operating systems to address five critical vulnerabilities in the OpenSSH package:
-
CVE-2023-28531 (CVSS score 9.8) - this vulnerability relates to an error in communicating constraints to the ssh-agent when adding smartcard keys, potentially leading to unauthorized access or misuse of keys.
-
CVE-2023-51385( CVSS score 9.8) - this flaw poses a command injection risk in ssh when an invalid user or hostname containing shell metacharacters is used, especially in contexts like ProxyCommand or LocalCommand directives.
-
CVE-2021-41617 (CVSS score 7.0) - vulnerability that results in incorrect initialization of supplemental groups when executing AuthorizedKeysCommand or AuthorizedPrincipalsCommand, leading to potential unintended access.
-
CVE-2023-48795 (CVSS score 5.9) - Known as the Terrapin attack, exploits a prefix truncation issue in SSH, allowing a Man-in-the-Middle attack to compromise the integrity of encrypted SSH transport.
-
CVE-2023-51384 (CVSS score 5.5) - this issue involves PKCS#11-hosted private keys, where applying destination constraints to multiple keys returned by a PKCS#11 token only affects the first key, potentially leading to unintended access or misuse of keys.
Users should update their OpenSSH packages.
