Red Hat Security AdvisoryRHSA-2008:0855
openssh security update
Released 2008-08-22 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) openssh-4.3p2-26.el5_2.1, openssh-4.3p2-26.el5_2.1.i386, openssh-4.3p2-26.el5_2.1.ia64 +13
- Red Hat Enterprise Linux AS EUS (v. 4.5) openssh-3.9p1-10.RHEL4.20, openssh-3.9p1-10.RHEL4.20.i386, openssh-3.9p1-10.RHEL4.20.ia64 +17
- Red Hat Enterprise Linux AS version 4 openssh-3.9p1-11.el4_7, openssh-3.9p1-11.el4_7.i386, openssh-3.9p1-11.el4_7.ia64 +17
- Red Hat Enterprise Linux Desktop (v. 5 client) openssh-4.3p2-26.el5_2.1, openssh-4.3p2-26.el5_2.1.i386, openssh-askpass-4.3p2-26.el5_2.1 +5
- Red Hat Enterprise Linux Desktop version 4 openssh-3.9p1-11.el4_7, openssh-3.9p1-11.el4_7.i386, openssh-askpass-3.9p1-11.el4_7 +7
- Red Hat Enterprise Linux ES EUS (v. 4.5) openssh-3.9p1-10.RHEL4.20, openssh-3.9p1-10.RHEL4.20.i386, openssh-3.9p1-10.RHEL4.20.ia64 +12
- Red Hat Enterprise Linux ES version 4 openssh-3.9p1-11.el4_7, openssh-3.9p1-11.el4_7.i386, openssh-3.9p1-11.el4_7.ia64 +12
- Red Hat Enterprise Linux WS version 4 openssh-3.9p1-11.el4_7, openssh-3.9p1-11.el4_7.i386, openssh-3.9p1-11.el4_7.ia64 +12
Fixes 2 records
Priority MEDIUM 45
Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain an externally introduced modification (Trojan Horse) that allows the package auth…
CVSS 2.0HIGH 9.3· Network · No auth · Interaction — · EPSS 0.02662 · Published 2008-08-27 · Fixed CWE-20
Priority LOW 37
ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X c…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.02374 · Published 2007-09-12 · Fixed CWE-20
