Skip to content
OpenAdvisories
Low ALAS2-2018-1075 1 CVE

Low: openssh security update (Amazon Linux 2)

Published Sep 20, 2018 · Updated Sep 25, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-15473: OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. 1619063: CVE-2018-15473 openssh: User enumeration via malformed packets in authentication requests

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 openssh 0:7.4p1-16.amzn2.0.5
Amazon Linux · 2 openssh-askpass 0:7.4p1-16.amzn2.0.5
Amazon Linux · 2 openssh-cavs 0:7.4p1-16.amzn2.0.5
Amazon Linux · 2 openssh-clients 0:7.4p1-16.amzn2.0.5
Amazon Linux · 2 openssh-debuginfo 0:7.4p1-16.amzn2.0.5
Amazon Linux · 2 openssh-keycat 0:7.4p1-16.amzn2.0.5
Amazon Linux · 2 openssh-ldap 0:7.4p1-16.amzn2.0.5
Amazon Linux · 2 openssh-server 0:7.4p1-16.amzn2.0.5
Amazon Linux · 2 openssh-server-sysvinit 0:7.4p1-16.amzn2.0.5
Amazon Linux · 2 pam_ssh_agent_auth 0:0.10.3-2.16.amzn2.0.5

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-15473.html