Бюллетень безопасности RHSA-2019:3702

Высокая (5.8)

(AV:N/AC:M/Au:N/C:N/I:P/A:P)

RedHat

openssh (any, Unknown) openssh-askpass (any) openssh-cavs (any) openssh-clients (any) openssh-debugsource (any) openssh-keycat (any) openssh-ldap (any) openssh-server (any) pam_ssh_agent_auth (any)

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

The following packages have been upgraded to a later upstream version: openssh (8.0p1). (BZ#1691045)

Security Fix(es):

* openssh: scp client improper directory name validation (CVE-2018-20685)

* openssh: Improper validation of object names allows malicious server to overwrite files via scp client (CVE-2019-6111)

* openssh: Missing character encoding in progress display allows for spoofing of scp client output (CVE-2019-6109)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.

Используйте рекомендации производителя, доступные по ссылке https://access.redhat.com/knowledge/articles/11258

Источник: CVE
Наименование: CVE-2018-20685
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20685

Источник: CVE
Наименование: CVE-2019-6109
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6109

Источник: CVE
Наименование: CVE-2019-6111
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111

https://access.redhat.com/errata/RHSA-2019:3702