Red Hat Security Advisory: openssh security, bug fix, and enhancement update

Fixed packages 40

Vulnerabilities 6

• High 7.8
  CVE-2016-10012

  The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensur…

  openssh openssh openssh Debian Ubuntu Alpine
  Jan 5, 2017
• High 7.5
  CVE-2016-10708 Public exploit EPSS 16%

  sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon cr…

  openssh openssh Debian Ubuntu
  Jan 21, 2018
• High 7.3
  CVE-2016-10009 Public exploit EPSS 37%

  Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execut…

  openssh openssh openssh Debian Ubuntu Alpine
  Jan 5, 2017
• Medium 6.2
  CVE-2016-10011

  authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which mi…

  openssh openssh openssh Debian Ubuntu Alpine
  Jan 5, 2017
• Medium 5.9
  CVE-2016-6210 Public exploit EPSS 89%

  sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static…

  openssh openssh openssh Debian Ubuntu Alpine
  Feb 13, 2017
• Unscored —
  CVE-2016-6515 Public exploit EPSS 59%

  The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password …

  openssh openssh openssh Debian Ubuntu Alpine
  Aug 7, 2016

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1357442
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1360973
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1364935
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1366400
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1373835
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1375179
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1381997
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1396400
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1398569
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1402424
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1406269
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1406286
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1406293
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1418062
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1420910
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1438414
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1450361
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2029.json
• report
  https://access.redhat.com/security/cve/CVE-2016-6210
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-6210
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-6210
• report
  https://access.redhat.com/security/cve/CVE-2016-6515
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-6515
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-6515
• report
  https://access.redhat.com/security/cve/CVE-2016-10009
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-10009
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-10009
• article
  https://www.openssh.com/txt/release-7.4
• report
  https://access.redhat.com/security/cve/CVE-2016-10011
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-10011
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-10011
• report
  https://access.redhat.com/security/cve/CVE-2016-10012
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-10012
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-10012
• report
  https://access.redhat.com/security/cve/CVE-2016-10708
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1537929
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-10708