Red Hat Security AdvisoryRHSA-2017:2029
openssh security, bug fix, and enhancement update
Released 2017-08-01 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) openssh-7.4p1-11.el7, openssh-askpass-7.4p1-11.el7, openssh-clients-7.4p1-11.el7 +2
- Red Hat Enterprise Linux Client Optional (v. 7) openssh-cavs-7.4p1-11.el7, openssh-ldap-7.4p1-11.el7, openssh-server-sysvinit-7.4p1-11.el7 +1
- Red Hat Enterprise Linux ComputeNode (v. 7) openssh-7.4p1-11.el7, openssh-clients-7.4p1-11.el7, openssh-keycat-7.4p1-11.el7 +1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssh-askpass-7.4p1-11.el7, openssh-cavs-7.4p1-11.el7, openssh-ldap-7.4p1-11.el7 +2
- Red Hat Enterprise Linux Server (v. 7) openssh-7.4p1-11.el7, openssh-askpass-7.4p1-11.el7, openssh-clients-7.4p1-11.el7 +2
- Red Hat Enterprise Linux Server Optional (v. 7) openssh-cavs-7.4p1-11.el7, openssh-ldap-7.4p1-11.el7, openssh-server-sysvinit-7.4p1-11.el7 +2
- Red Hat Enterprise Linux Workstation (v. 7) openssh-7.4p1-11.el7, openssh-askpass-7.4p1-11.el7, openssh-clients-7.4p1-11.el7 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssh-cavs-7.4p1-11.el7, openssh-ldap-7.4p1-11.el7, openssh-server-sysvinit-7.4p1-11.el7 +1
Fixes 6 records
Priority HIGH 71
Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.37431 · Published 2017-01-05 · Partial fix CWE-426
Priority HIGH 69
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by lever…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.88944 · Published 2017-02-13 · Partial fix CWE-200
Priority HIGH 67
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) vi…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.58568 · Published 2016-08-07 · Partial fix CWE-20
Priority MEDIUM 55
sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packe…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.15716 · Published 2018-01-21 · Partial fix CWE-476
Priority LOW 39
The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.01281 · Published 2017-01-05 · Partial fix CWE-119
Priority LOW 30
authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege…
CVSS 3.1MEDIUM 6.2· Local · No auth · No interaction · EPSS 0.01101 · Published 2017-01-05 · Partial fix CWE-119
THREATIST.IORead the docs