エラータID: AXSA:2024-7493:01

Release date: 
Thursday, February 1, 2024 - 14:02
Affected Channels: 
Asianux Server 8 for x86_64

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es):

* ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)
* openssh: potential command injection via shell metacharacters (CVE-2023-51385)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in and (if CBC is used) the MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.


Update packages.

Additional Info: 



  1. openssh-8.0p1-19.el8_9.2.src.rpm
    MD5: feb3eefbd65dd4fb0b69803639388e72
    SHA-256: 4367325f8c926aef2b064921c862cbea5ae9070074be2532e93c2d8aee194077
    Size: 2.88 MB

Asianux Server 8 for x86_64
  1. openssh-8.0p1-19.el8_9.2.x86_64.rpm
    MD5: e9efd88da6217a299c703edd96bbdd4e
    SHA-256: b62955d93e7128f264a0db85efab25c85b5c33b062b926e8f6cc7eafffbcb3c1
    Size: 523.69 kB
  2. openssh-askpass-8.0p1-19.el8_9.2.x86_64.rpm
    MD5: 7fb988e2349b6e060ea980c194173e3c
    SHA-256: 1de9ba7bae8881aef08be60367aae092ec9a05db99af24e25d2d2546658747d2
    Size: 93.54 kB
  3. openssh-cavs-8.0p1-19.el8_9.2.x86_64.rpm
    MD5: 7505cd84ca4322f40386f72f6f120e7f
    SHA-256: 2c104233e2e15e21b4f8f336fb4454e52847523f3d28646f700968a3540f19ae
    Size: 232.04 kB
  4. openssh-clients-8.0p1-19.el8_9.2.x86_64.rpm
    MD5: f57ebf939f82101bd8aabb7bfe942bb4
    SHA-256: 9c9e0f968ea5557e8587d0138b4337d21946e03fa59a3d7f4f0d57edf3b8b84d
    Size: 643.46 kB
  5. openssh-keycat-8.0p1-19.el8_9.2.x86_64.rpm
    MD5: 07d36d189961dc6c8d383c2ebe43b4c1
    SHA-256: 92d7093efd2ff544e672bc6dc3a119df6d3ff11dd8b90124736e48d6a4105ca1
    Size: 116.82 kB
  6. openssh-ldap-8.0p1-19.el8_9.2.x86_64.rpm
    MD5: 5d193ac30c233bd3bfa9c7cfd997e0e4
    SHA-256: 596d15f6622e4bbfdbcd2345ed02693dd38a8ebbb257ab8e1e7eec4baf237b7b
    Size: 132.70 kB
  7. openssh-server-8.0p1-19.el8_9.2.x86_64.rpm
    MD5: a2b35da940af822cf745c9637bc773fb
    SHA-256: 51c7ff619e0ac1d7f141f62267db67427be1f1d1dc72233d14ed0c024eefe2a9
    Size: 492.59 kB
  8. pam_ssh_agent_auth-0.10.3-7.19.el8_9.2.x86_64.rpm
    MD5: 4d63863943e12d2af53b8fa0fd8fb1a8
    SHA-256: 69c11b3ea0619c1bc805644bda86a52505f440b626b14f2a7e23584e81282b76
    Size: 208.34 kB