UbuntuUpdates.org

Package "ssh"

Name: ssh

Description:

secure shell client and server (metapackage)
Latest version: 1:7.6p1-4ubuntu0.7
Release: bionic (18.04)
Level: updates
Repository: main
Head package: openssh
Homepage: http://www.openssh.com/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "ssh"

All arch deb package
APT INSTALL

Other versions of "ssh" in Bionic

Repository Area Version
base main 1:7.6p1-4
security main 1:7.6p1-4ubuntu0.5

Changelog

Version: 1:7.6p1-4ubuntu0.7 2022-05-12 03:06:19 UTC

  openssh (1:7.6p1-4ubuntu0.7) bionic; urgency=medium

  * d/p/fix-connect-timeout-overflow.patch: prevent ConnectTimeout overflow.
    (LP: #1903516)

  [ Sergio Durigan Junior ]
  * d/p/lp1966591-upstream-preserve-group-world-read-permission-on-kno.patch:
    Preserve group/world read permissions on known_hosts. (LP: #1966591)

 -- Athos Ribeiro <email address hidden> Wed, 30 Mar 2022 10:17:14 -0300
Source diff to previous version
1903516 aborted (core dumped) when using ConnectTimeout \u003e 2147483
1966591 ssh-keygen -R changes known_hosts file permissions (mode)

Version: 1:7.6p1-4ubuntu0.6 2022-02-15 22:06:17 UTC

  openssh (1:7.6p1-4ubuntu0.6) bionic; urgency=medium

  * fix clients advertising version 1.99 (LP: #1863930)
    - d/p/lp-1863930-Fix-logic-bug-in-sshd_exchange_identification.patch
    - d/p/lp-1863930-unbreak-clients-that-advertise-protocol.patch

 -- Christian Ehrhardt <email address hidden> Tue, 03 Mar 2020 07:47:02 +0100
Source diff to previous version
1863930 SSH 1.99 clients fail to connect to openssh-server 1:7.6p1-4ubuntu0.3

Version: 1:7.6p1-4ubuntu0.5 2021-08-12 14:06:17 UTC

  openssh (1:7.6p1-4ubuntu0.5) bionic-security; urgency=medium

  * SECURITY REGRESSION: User enumeration issue (LP: #1934501)
    - debian/patches/CVE-2018-15473.patch: updated to fix bad patch
      backport.

 -- Marc Deslauriers <email address hidden> Wed, 11 Aug 2021 14:02:09 -0400
Source diff to previous version
1934501 CVE-2018-15473 patch introduce user enumeration vulnerability
CVE-2018-15473 OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packe

Version: 1:7.6p1-4ubuntu0.3 2019-03-04 21:07:10 UTC

  openssh (1:7.6p1-4ubuntu0.3) bionic-security; urgency=medium

  * SECURITY UPDATE: Incomplete fix for CVE-2019-6111
    - debian/patches/CVE-2019-6111-2.patch: add another fix to the filename
      check in scp.c.
    - CVE-2019-6111
  * Fixed inverted CVE numbers in patch filenames and in previous
    changelog.

 -- Marc Deslauriers <email address hidden> Mon, 04 Mar 2019 07:17:51 -0500
Source diff to previous version
CVE-2019-6111 An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sen

Version: 1:7.6p1-4ubuntu0.2 2019-02-07 21:07:16 UTC

  openssh (1:7.6p1-4ubuntu0.2) bionic-security; urgency=medium

  * SECURITY UPDATE: access restrictions bypass in scp
    - debian/patches/CVE-2018-20685.patch: disallow empty filenames
      or ones that refer to the current directory in scp.c.
    - CVE-2018-20685
  * SECURITY UPDATE: scp client spoofing via object name
    - debian/patches/CVE-2019-6109.patch: make sure the filenames match
      the wildcard specified by the user, and add new flag to relax the new
      restrictions in scp.c, scp.1.
    - CVE-2019-6109
  * SECURITY UPDATE: scp client missing received object name validation
    - debian/patches/CVE-2019-6111-1.patch: sanitize scp filenames via
      snmprintf in atomicio.c, progressmeter.c, progressmeter.h,
      scp.c, sftp-client.c.
    - debian/patches/CVE-2019-6111-2.patch: force progressmeter updates in
      progressmeter.c, progressmeter.h, scp.c, sftp-client.c.
    - CVE-2019-6111

 -- Marc Deslauriers <email address hidden> Thu, 31 Jan 2019 08:58:34 -0500
CVE-2018-20685 In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename.
CVE-2019-6109 An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker)
CVE-2019-6111 An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sen


About   -   Send Feedback to @ubuntu_updates