Headline
Red Hat Security Advisory 2023-4329-01
Red Hat Security Advisory 2023-4329-01 - OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Issues addressed include a code execution vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: openssh security update
Advisory ID: RHSA-2023:4329-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:4329
Issue date: 2023-07-31
CVE Names: CVE-2023-38408
=====================================================================
- Summary:
An update for openssh is now available for Red Hat Enterprise Linux 9.0
Extended Update Support.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux AppStream EUS (v.9.0) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux BaseOS EUS (v.9.0) - aarch64, ppc64le, s390x, x86_64
- Description:
OpenSSH is an SSH protocol implementation supported by a number of Linux,
UNIX, and similar operating systems. It includes the core files necessary
for both the OpenSSH client and server.
Security Fix(es):
- openssh: Remote code execution in ssh-agent PKCS#11 support
(CVE-2023-38408)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, the OpenSSH server daemon (sshd) will be
restarted automatically.
- Bugs fixed (https://bugzilla.redhat.com/):
2224173 - CVE-2023-38408 openssh: Remote code execution in ssh-agent PKCS#11 support
- Package List:
Red Hat Enterprise Linux AppStream EUS (v.9.0):
aarch64:
openssh-askpass-8.7p1-11.el9_0.aarch64.rpm
openssh-askpass-debuginfo-8.7p1-11.el9_0.aarch64.rpm
openssh-clients-debuginfo-8.7p1-11.el9_0.aarch64.rpm
openssh-debuginfo-8.7p1-11.el9_0.aarch64.rpm
openssh-debugsource-8.7p1-11.el9_0.aarch64.rpm
openssh-keycat-debuginfo-8.7p1-11.el9_0.aarch64.rpm
openssh-server-debuginfo-8.7p1-11.el9_0.aarch64.rpm
pam_ssh_agent_auth-0.10.4-4.11.el9_0.aarch64.rpm
pam_ssh_agent_auth-debuginfo-0.10.4-4.11.el9_0.aarch64.rpm
ppc64le:
openssh-askpass-8.7p1-11.el9_0.ppc64le.rpm
openssh-askpass-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
openssh-clients-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
openssh-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
openssh-debugsource-8.7p1-11.el9_0.ppc64le.rpm
openssh-keycat-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
openssh-server-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
pam_ssh_agent_auth-0.10.4-4.11.el9_0.ppc64le.rpm
pam_ssh_agent_auth-debuginfo-0.10.4-4.11.el9_0.ppc64le.rpm
s390x:
openssh-askpass-8.7p1-11.el9_0.s390x.rpm
openssh-askpass-debuginfo-8.7p1-11.el9_0.s390x.rpm
openssh-clients-debuginfo-8.7p1-11.el9_0.s390x.rpm
openssh-debuginfo-8.7p1-11.el9_0.s390x.rpm
openssh-debugsource-8.7p1-11.el9_0.s390x.rpm
openssh-keycat-debuginfo-8.7p1-11.el9_0.s390x.rpm
openssh-server-debuginfo-8.7p1-11.el9_0.s390x.rpm
pam_ssh_agent_auth-0.10.4-4.11.el9_0.s390x.rpm
pam_ssh_agent_auth-debuginfo-0.10.4-4.11.el9_0.s390x.rpm
x86_64:
openssh-askpass-8.7p1-11.el9_0.x86_64.rpm
openssh-askpass-debuginfo-8.7p1-11.el9_0.x86_64.rpm
openssh-clients-debuginfo-8.7p1-11.el9_0.x86_64.rpm
openssh-debuginfo-8.7p1-11.el9_0.x86_64.rpm
openssh-debugsource-8.7p1-11.el9_0.x86_64.rpm
openssh-keycat-debuginfo-8.7p1-11.el9_0.x86_64.rpm
openssh-server-debuginfo-8.7p1-11.el9_0.x86_64.rpm
pam_ssh_agent_auth-0.10.4-4.11.el9_0.x86_64.rpm
pam_ssh_agent_auth-debuginfo-0.10.4-4.11.el9_0.x86_64.rpm
Red Hat Enterprise Linux BaseOS EUS (v.9.0):
Source:
openssh-8.7p1-11.el9_0.src.rpm
aarch64:
openssh-8.7p1-11.el9_0.aarch64.rpm
openssh-askpass-debuginfo-8.7p1-11.el9_0.aarch64.rpm
openssh-clients-8.7p1-11.el9_0.aarch64.rpm
openssh-clients-debuginfo-8.7p1-11.el9_0.aarch64.rpm
openssh-debuginfo-8.7p1-11.el9_0.aarch64.rpm
openssh-debugsource-8.7p1-11.el9_0.aarch64.rpm
openssh-keycat-8.7p1-11.el9_0.aarch64.rpm
openssh-keycat-debuginfo-8.7p1-11.el9_0.aarch64.rpm
openssh-server-8.7p1-11.el9_0.aarch64.rpm
openssh-server-debuginfo-8.7p1-11.el9_0.aarch64.rpm
pam_ssh_agent_auth-debuginfo-0.10.4-4.11.el9_0.aarch64.rpm
ppc64le:
openssh-8.7p1-11.el9_0.ppc64le.rpm
openssh-askpass-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
openssh-clients-8.7p1-11.el9_0.ppc64le.rpm
openssh-clients-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
openssh-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
openssh-debugsource-8.7p1-11.el9_0.ppc64le.rpm
openssh-keycat-8.7p1-11.el9_0.ppc64le.rpm
openssh-keycat-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
openssh-server-8.7p1-11.el9_0.ppc64le.rpm
openssh-server-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
pam_ssh_agent_auth-debuginfo-0.10.4-4.11.el9_0.ppc64le.rpm
s390x:
openssh-8.7p1-11.el9_0.s390x.rpm
openssh-askpass-debuginfo-8.7p1-11.el9_0.s390x.rpm
openssh-clients-8.7p1-11.el9_0.s390x.rpm
openssh-clients-debuginfo-8.7p1-11.el9_0.s390x.rpm
openssh-debuginfo-8.7p1-11.el9_0.s390x.rpm
openssh-debugsource-8.7p1-11.el9_0.s390x.rpm
openssh-keycat-8.7p1-11.el9_0.s390x.rpm
openssh-keycat-debuginfo-8.7p1-11.el9_0.s390x.rpm
openssh-server-8.7p1-11.el9_0.s390x.rpm
openssh-server-debuginfo-8.7p1-11.el9_0.s390x.rpm
pam_ssh_agent_auth-debuginfo-0.10.4-4.11.el9_0.s390x.rpm
x86_64:
openssh-8.7p1-11.el9_0.x86_64.rpm
openssh-askpass-debuginfo-8.7p1-11.el9_0.x86_64.rpm
openssh-clients-8.7p1-11.el9_0.x86_64.rpm
openssh-clients-debuginfo-8.7p1-11.el9_0.x86_64.rpm
openssh-debuginfo-8.7p1-11.el9_0.x86_64.rpm
openssh-debugsource-8.7p1-11.el9_0.x86_64.rpm
openssh-keycat-8.7p1-11.el9_0.x86_64.rpm
openssh-keycat-debuginfo-8.7p1-11.el9_0.x86_64.rpm
openssh-server-8.7p1-11.el9_0.x86_64.rpm
openssh-server-debuginfo-8.7p1-11.el9_0.x86_64.rpm
pam_ssh_agent_auth-debuginfo-0.10.4-4.11.el9_0.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2023-38408
https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJkx8M/AAoJENzjgjWX9erEXxEP/2v6d41soiJeC4s8E8oBYSMV
nMliXdwT2hQ4Ld+qgzFKw+xAroNaGvtS28okVqtM/YzFi1s68DUoOoy7M1FLDs8p
xANDyQ8P0oxIz+wouX55+8cad3GZiuzDP0T+CSqq+q+RpmMP2/bvoFbGYFSf8AAk
8XehQcPMm4quEv+VP26bIlBUuxfAl8ZZzPJGEFQegVCqy6zupFGmzpojeIvHrvMb
WPNN0cBMQQtgi81opawWkV3zscSE6UryGGrS6hh/n7yFjnZtrGVsTOAXRLX9ru6b
lkF9tN3A//LLjcmKpxkNdLn0B2+uU7ONSFy9OxgaXTTlCmRg2Rw0SDu/Pm0SNaqN
IY+p2yO1DXl5RYJqrnIq3/iBC+L3GeyhpjMdj2BDC4HRhQ0s5Ygpskc2xKvxSyQf
qg5Xl0OchWMFr4u7fRvj7pY7q/HXRSNasn+ZIuPt+cSO+Scw99I4Y9FJzYjWrFzg
mrq3zu7OzVIcjFxa+HfbRvhm3NbIVMcbuG2KEopdQRZ9r1MHLDFxmWWuOtNcavFd
bXzerei012+UMeV3R1oalmJaRdQNFKAHgTbDCV6tBxwgEDm1Z0rDwlFPdbnTA1Vk
OO6LhMyGuNPd03zRV1aiBEdniN0HGi5MucgK9+LorXdGqZ2PFc5wKmsaXQENiUaY
YXBTCnnpgSw5dBDBy8Gj
=ZYYk
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Dell vApp Manger, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote attacker could potentially exploit this vulnerability to read arbitrary files from the target system.
IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 254138
Red Hat Security Advisory 2023-5103-01 - OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization 4.11.6 images.
An update is now available for Red Hat OpenShift GitOps 1.9. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-40029: A flaw was found in the ArgoCD package, used by Red Hat GitOps, that allows cluster secrets to be managed declaratively using the `kubectl apply` functionality, resulting in the full secret body being stored in `kubectl.kubernetes.io/last-applied-configuration` annotation. Since ArgoCD has included the ability to manage cluster labels and annotations via i...
Red Hat Security Advisory 2023-4982-01 - OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization 4.12.6 images.
Red Hat Security Advisory 2023-4972-01 - Multicluster Engine for Kubernetes 2.1.8 images Multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy. Issues addressed include a bypass vulnerability.
Red Hat Security Advisory 2023-4893-01 - The Migration Toolkit for Containers enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API.
Red Hat DevWorkspace Operator 0.22 has been released. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38408: A vulnerability was found in OpenSSH. The PKCS#11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system (the code in /usr/lib is not necessarily safe for loading into ssh-agent). This flaw allows an attacker with control of the forwarded agent-...
Red Hat Security Advisory 2023-4875-01 - Red Hat Advanced Cluster Management for Kubernetes 2.8.1 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which provide security updates and fix several bugs. Issues addressed include bypass and privilege escalation vulnerabilities.
IBM AIX 7.2, 7.3, VIOS 3.1's OpenSSH implementation could allow a non-privileged local user to access files outside of those allowed due to improper access controls. IBM X-Force ID: 263476.
Red Hat Security Advisory 2023-4650-01 - Multicluster Engine for Kubernetes 2.2.7 images Multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.
Red Hat Security Advisory 2023-4576-01 - VolSync is a Kubernetes operator that enables asynchronous replication of persistent volumes within a cluster, or across clusters.
Red Hat Security Advisory 2023-4456-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.13.8. Issues addressed include an add administrator vulnerability.
Red Hat Security Advisory 2023-4428-01 - OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Issues addressed include a code execution vulnerability.
Red Hat Security Advisory 2023-4419-01 - OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Issues addressed include a code execution vulnerability.
An update for openssh is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38408: A vulnerability was found in OpenSSH. The PKCS#11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system (the code in /usr/lib is not necessarily safe for loading into ssh-agent). This flaw allows an a...
Ubuntu Security Notice 6242-2 - USN-6242-1 fixed a vulnerability in OpenSSH. This update provides the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. It was discovered that OpenSSH incorrectly handled loading certain PKCS#11 providers. If a user forwarded their ssh-agent to an untrusted system, a remote attacker could possibly use this issue to load arbitrary libraries from the user's system and execute arbitrary code.
An update for openssh is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38408: A vulnerability was found in OpenSSH. The PKCS#11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system (the code in /usr/lib is not necessarily safe for loading into ssh-agent). This flaw allows an attacker with control of the...
An update for openssh is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38408: A vulnerability was found in OpenSSH. The PKCS#11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarde...
An update for openssh is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38408: A vulnerability was found in OpenSSH. The PKCS#11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system (the code in /usr/lib is not necessarily safe for loading into ssh-agent). This flaw al...
An update for openssh is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38408: A vulnerability was found in OpenSSH. The PKCS#11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an ...
An update for openssh is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38408: A vulnerability was found in OpenSSH. The PKCS#11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system (the code in /usr/lib is not necessarily safe for loading into ssh-agent). This flaw allows an at...
Ubuntu Security Notice 6242-1 - It was discovered that OpenSSH incorrectly handled loading certain PKCS#11 providers. If a user forwarded their ssh-agent to an untrusted system, a remote attacker could possibly use this issue to load arbitrary libraries from the user's system and execute arbitrary code.
Details have emerged about a now-patched flaw in OpenSSH that could be potentially exploited to run arbitrary commands remotely on compromised hosts under specific conditions. "This vulnerability allows a remote attacker to potentially execute arbitrary commands on vulnerable OpenSSH's forwarded ssh-agent," Saeed Abbasi, manager of vulnerability research at Qualys, said in an analysis last week.
The PKCS#11 feature in ssh-agent in OpenSSH versions prior to 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system.
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.