UbuntuUpdates.org

Package "ssh"

Name: ssh

Description:

secure shell client and server (metapackage)
Latest version: 1:8.9p1-3ubuntu0.10
Release: jammy (22.04)
Level: updates
Repository: main
Head package: openssh
Homepage: http://www.openssh.com/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "ssh"

All arch deb package
APT INSTALL

Other versions of "ssh" in Jammy

Repository Area Version
base main 1:8.9p1-3
security main 1:8.9p1-3ubuntu0.10

Changelog

Version: 1:8.9p1-3ubuntu0.10 2024-07-01 13:07:02 UTC

  openssh (1:8.9p1-3ubuntu0.10) jammy-security; urgency=medium

  * SECURITY UPDATE: remote code execution via signal handler race
    condition (LP: #2070497)
    - debian/patches/CVE-2024-6387.patch: don't log in sshsigdie() in log.c.
    - CVE-2024-6387

 -- Marc Deslauriers <email address hidden> Wed, 26 Jun 2024 09:11:55 -0400
Source diff to previous version

Version: 1:8.9p1-3ubuntu0.7 2024-04-17 13:06:53 UTC

  openssh (1:8.9p1-3ubuntu0.7) jammy; urgency=medium

  * d/p/gssapi.patch: fix method_gsskeyex structure and
    userauth_gsskeyex function regarding changes introduced in upstream
    commit dbb339f015c33d63484261d140c84ad875a9e548 ("prepare for
    multiple names for authmethods") (LP: #2053146)
  * d/t/{ssh-gssapi,util}: ssh-gssapi DEP8 test for gssapi-with-mic
    and gssapi-keyex authentication methods

 -- Andreas Hasenack <email address hidden> Fri, 15 Mar 2024 17:28:22 -0300
Source diff to previous version
2053146 openssh 8.9p1 for Jammy auth2-gss patch for gssapi-keyex method is slightly wrong

Version: 1:8.9p1-3ubuntu0.6 2024-01-03 21:07:23 UTC

  openssh (1:8.9p1-3ubuntu0.6) jammy-security; urgency=medium

  * SECURITY UPDATE: incomplete PKCS#11 destination constraints
    - debian/patches/CVE-2023-51384.patch: apply destination constraints to
      all p11 keys in ssh-agent.c.
    - CVE-2023-51384
  * SECURITY UPDATE: command injection via shell metacharacters
    - debian/patches/CVE-2023-51385.patch: ban user/hostnames with most
      shell metacharacters in ssh.c.
    - CVE-2023-51385

 -- Marc Deslauriers <email address hidden> Tue, 02 Jan 2024 11:54:04 -0500
Source diff to previous version
CVE-2023-51384 In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during ad
CVE-2023-51385 In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by a

Version: 1:8.9p1-3ubuntu0.5 2023-12-19 17:07:38 UTC

  openssh (1:8.9p1-3ubuntu0.5) jammy-security; urgency=medium

  * SECURITY UPDATE: Prefix truncation attack on BPP
    - debian/patches/CVE-2023-48795.patch: implement "strict key exchange"
      in PROTOCOL, kex.c, kex.h, packet.c, sshconnect2.c, sshd.c.
    - CVE-2023-48795
  * SECURITY UPDATE: smartcard constraints not added to agent
    - debian/patches/CVE-2023-28531.patch: include destination constraints
      for smartcard keys too in authfd.c.
    - CVE-2023-28531

 -- Marc Deslauriers <email address hidden> Mon, 18 Dec 2023 11:28:16 -0500
Source diff to previous version
CVE-2023-48795 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integri
CVE-2023-28531 ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is

Version: 1:8.9p1-3ubuntu0.4 2023-09-14 17:06:54 UTC

  openssh (1:8.9p1-3ubuntu0.4) jammy; urgency=medium

  * d/p/fix-authorized-principals-command.patch: Fix the situation where
    sshd ignores AuthorizedPrincipalsCommand if AuthorizedKeysCommand
    is also set by checking if the value pointed to by the pointer
    'charptr' is NULL. (LP: #2031942)

 -- Michal Maloszewski <email address hidden> Thu, 24 Aug 2023 15:40:24 +0200
2031942 AuthorizedPrincipalsCommand is ignored if AuthorizedKeysCommand is set


About   -   Send Feedback to @ubuntu_updates