Failles dans openssh

[piratebab]

Une faille corrigée dans open ssh. Mettez à jour vers 8.3
https://www.openssh.com/txt/release-8.3
Le premier qui la voit dans les dépots debian nous fait signe

[lol]

Salut,

Je ne comprenais pas.
Tu parles de testing évidemment!

En stable on est encore à la 7.9...
7.9p1-10+deb10u2

[piratebab]

Lol,
la 7.9 est concernée par au moins 3 CVE

CVE-2019-6111 An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
CVE-2019-6110 In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.
CVE-2019-6109 An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.

Celle là est pas mal non plus, et un peu plus ancienne

CVE-2018-20685 In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.

patchée par l'équipe debian-security, pour certaines
https://www.debian.org/security/2019/dsa-4387

Références dans la base de données de sécurité :
Dans le système de suivi des bogues Debian : Bogue 793412, Bogue 919101.
Dans le dictionnaire CVE du Mitre : CVE-2018-20685, CVE-2019-6109, CVE-2019-6111.