Skip to content
OpenAdvisories
Medium ALAS2-2023-2376 1 CVE

Moderate: openssh security update (Amazon Linux 2)

Published Dec 18, 2023 · Updated Dec 19, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-48795: AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A protocol extension has been introduced by OpenSSH which needs to be applied to both the client and the server in order to address this issue. We recommend customers update to the latest version of SSH.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 openssh 0:7.4p1-22.amzn2.0.6
Amazon Linux · 2 openssh-askpass 0:7.4p1-22.amzn2.0.6
Amazon Linux · 2 openssh-cavs 0:7.4p1-22.amzn2.0.6
Amazon Linux · 2 openssh-clients 0:7.4p1-22.amzn2.0.6
Amazon Linux · 2 openssh-debuginfo 0:7.4p1-22.amzn2.0.6
Amazon Linux · 2 openssh-keycat 0:7.4p1-22.amzn2.0.6
Amazon Linux · 2 openssh-ldap 0:7.4p1-22.amzn2.0.6
Amazon Linux · 2 openssh-server 0:7.4p1-22.amzn2.0.6
Amazon Linux · 2 openssh-server-sysvinit 0:7.4p1-22.amzn2.0.6
Amazon Linux · 2 pam_ssh_agent_auth 0:0.10.3-2.22.amzn2.0.6

Vulnerabilities 1

  • Medium 5.9
    CVE-2023-48795 Public exploit Scanner template EPSS 94%

    Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

    zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-48795.html