Security update for openssh
Announcement ID: | SUSE-SU-2018:2275-1 |
Rating: | moderate |
References: | #1016370 #1017099 #1023275 #1053972 #1065000 #1069509 #1076957 |
Affected Products: |
An update that solves four vulnerabilities and has three fixes is now available.
Description:
This update for openssh fixes the following issues:
Security issues fixed:
- CVE-2016-10012: Fix pre-auth compression checks that could be optimized
away (bsc#1016370).
- CVE-2016-10708: Fix remote denial of service (NULL pointer dereference
and daemon crash) via an out-of-sequence NEWKEYSmessage (bsc#1076957).
- CVE-2017-15906: Fix r/o sftp-server zero byte file creation
(bsc#1065000).
- CVE-2008-1483: Fix accidental re-introduction of CVE-2008-1483
(bsc#1069509).
Bug fixes:
- bsc#1017099: Match conditions with uppercase hostnames fail (bsc#1017099)
- bsc#1053972: supportedKeyExchanges diffie-hellman-group1-sha1 is
duplicated (bsc#1053972)
- bsc#1023275: Messages suppressed after upgrade from SLES 11 SP3 to SP4
(bsc#1023275)
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 11-SP4:
zypper in -t patch slessp4-openssh-13719=1
- SUSE Linux Enterprise Debuginfo 11-SP4:
zypper in -t patch dbgsp4-openssh-13719=1
Package List:
- SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):
- openssh-6.6p1-36.3.1
- openssh-askpass-gnome-6.6p1-36.3.1
- openssh-fips-6.6p1-36.3.1
- openssh-helpers-6.6p1-36.3.1
- SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):
- openssh-askpass-gnome-debuginfo-6.6p1-36.3.1
- openssh-debuginfo-6.6p1-36.3.1
- openssh-debugsource-6.6p1-36.3.1
References:
- https://www.suse.com/security/cve/CVE-2008-1483.html
- https://www.suse.com/security/cve/CVE-2016-10012.html
- https://www.suse.com/security/cve/CVE-2016-10708.html
- https://www.suse.com/security/cve/CVE-2017-15906.html
- https://bugzilla.suse.com/1016370
- https://bugzilla.suse.com/1017099
- https://bugzilla.suse.com/1023275
- https://bugzilla.suse.com/1053972
- https://bugzilla.suse.com/1065000
- https://bugzilla.suse.com/1069509
- https://bugzilla.suse.com/1076957