Summary
USN-6242-1 fixed a vulnerability in OpenSSH. This update provides
the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
and Ubuntu 18.04 LTS.
Original advisory details:
It was discovered that OpenSSH incorrectly handled loading certain PKCS#11
providers. If a user forwarded their ssh-agent to an untrusted system, a
remote attacker could possibly use this issue to load arbitrary libraries
from the user's system and execute arbitrary code.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | openssh | 1:6.6p1-2ubuntu2.13+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | openssh | 1:7.2p2-4ubuntu2.10+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | openssh | 1:7.6p1-4ubuntu0.7+esm1 |
Vulnerabilities 1
-
Critical 9.8
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remo…
References
-
report
https://ubuntu.com/security/CVE-2023-38408