Tuesday, July 9, 2024

[USN-6887-1] OpenSSH vulnerability

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmaNZ8IACgkQZWnYVadE
vpPpzw/+IluKUhdzSDRkWTqSJWBYWMQBn4AjHCd2M7+GXDlSmTjbg2ZPudDw9LPU
VKyK2fCsEIjVoiAljNGv/JBezcuzW0IWn+8WdWWtBwVmg8GnD0Js2tmDTjPrydsU
usGHriG61fiSYeW5oPto9lruzL0f1UMYBGdV9LPQWBV0VEvmXrhAQ3m4+evk2oCd
sS5h3dXSTSd7dD/TAC2F8/HQfUdz5ID6p9lJoHRZXDpsXCrXL0sMlHKoTS9hL/GZ
Zi4K3XvzE6z9eoijVxcHi/rn+ozDd487qApZr3bFDvdrLDHowjklqT7H9IWK8oeD
Gq5hmxvMZKJQ529+gtar+6UmkjukvnxGlLNymm6E7wZAz27cfG9KZ9fU/9XPN0xt
S/pe6Qrbu1tpY7eTEyDFbW4vdka3q8M2A7Z3HqZqrU9Fy9PprAcSerL8UP7O1UA2
YvmWwc5JMcCYnaltHtwUbasc0abTZOw4wAeHd3nZKSAzuY3eo+/i42Yi83nHcfcc
njQVO5LQNr6cgZXxyfvjRjuD8tjb0y723ziNZnP0K8x8GgxKc28zZxFVXkIUfNdF
6qToQ/NewKx8cXoxzLiaqpi1NZyHw+YC+MjUiOxyoSxQybK3k43soTmd7G3oBLMd
qB6xhblJ6qZbh8JumukkyN2vXeYzNJaCh982cNzJpOoAdfTo59U=
=cbYB
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6887-1
July 09, 2024

openssh vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS

Summary:

OpenSSH could be made to expose timing information over the network.

Software Description:
- openssh: secure shell (SSH) for secure access to remote machines

Details:

Philippos Giavridis, Jacky Wei En Kung, Daniel Hugenroth, and Alastair
Beresford discovered that the OpenSSH ObscureKeystrokeTiming feature did
not work as expected. A remote attacker could possibly use this issue to
determine timing information about keystrokes.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
openssh-client 1:9.6p1-3ubuntu13.4
openssh-server 1:9.6p1-3ubuntu13.4

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6887-1
CVE-2024-39894

Package Information:
https://launchpad.net/ubuntu/+source/openssh/1:9.6p1-3ubuntu13.4

No comments:

Post a Comment