Red Hat Security AdvisoryRHSA-2016:0465
openssh security update
Released 2016-03-21 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) openssh-6.6.1p1-25.el7_2, openssh-askpass-6.6.1p1-25.el7_2, openssh-clients-6.6.1p1-25.el7_2 +2
- Red Hat Enterprise Linux Client Optional (v. 7) openssh-ldap-6.6.1p1-25.el7_2, openssh-server-sysvinit-6.6.1p1-25.el7_2, pam_ssh_agent_auth-0.9.3-9.25.el7_2
- Red Hat Enterprise Linux ComputeNode (v. 7) openssh-6.6.1p1-25.el7_2, openssh-clients-6.6.1p1-25.el7_2, openssh-keycat-6.6.1p1-25.el7_2 +1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssh-askpass-6.6.1p1-25.el7_2, openssh-ldap-6.6.1p1-25.el7_2, openssh-server-sysvinit-6.6.1p1-25.el7_2 +1
- Red Hat Enterprise Linux Server (v. 7) openssh-6.6.1p1-25.el7_2, openssh-askpass-6.6.1p1-25.el7_2, openssh-clients-6.6.1p1-25.el7_2 +2
- Red Hat Enterprise Linux Server Optional (v. 7) openssh-ldap-6.6.1p1-25.el7_2, openssh-server-sysvinit-6.6.1p1-25.el7_2, pam_ssh_agent_auth-0.9.3-9.25.el7_2 +1
- Red Hat Enterprise Linux Workstation (v. 7) openssh-6.6.1p1-25.el7_2, openssh-askpass-6.6.1p1-25.el7_2, openssh-clients-6.6.1p1-25.el7_2 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssh-ldap-6.6.1p1-25.el7_2, openssh-server-sysvinit-6.6.1p1-25.el7_2, pam_ssh_agent_auth-0.9.3-9.25.el7_2
Fixes 2 records
Priority MEDIUM 64
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.13736 · Published 2017-04-11 · Partial fix CWE-287
Priority MEDIUM 62
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_a…
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.3553 · Published 2016-03-22 · Partial fix CWE-93
