Skip to content
OpenAdvisories
Medium ALAS2-2023-2202 1 CVE

Moderate: openssh security update (Amazon Linux 2)

Published Aug 3, 2023 · Updated Aug 8, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-35812: An issue was discovered in OpenSSH 7.4 on Amazon Linux 2 and Amazon Linux 1. The fix for CVE-2019-6111 only covered cases where an absolute path is passed to scp. When a relative path is used there is no verification that the name of a file received by the client matches the file requested.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 openssh 0:7.4p1-22.amzn2.0.2
Amazon Linux · 2 openssh-askpass 0:7.4p1-22.amzn2.0.2
Amazon Linux · 2 openssh-cavs 0:7.4p1-22.amzn2.0.2
Amazon Linux · 2 openssh-clients 0:7.4p1-22.amzn2.0.2
Amazon Linux · 2 openssh-debuginfo 0:7.4p1-22.amzn2.0.2
Amazon Linux · 2 openssh-keycat 0:7.4p1-22.amzn2.0.2
Amazon Linux · 2 openssh-ldap 0:7.4p1-22.amzn2.0.2
Amazon Linux · 2 openssh-server 0:7.4p1-22.amzn2.0.2
Amazon Linux · 2 openssh-server-sysvinit 0:7.4p1-22.amzn2.0.2
Amazon Linux · 2 pam_ssh_agent_auth 0:0.10.3-2.22.amzn2.0.2

Vulnerabilities 1

  • Medium 5.3
    CVE-2023-35812

    An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete …

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-35812.html