Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Red Hat Enterprise Linux 7: RHSA-2018:0980-01 Low: OpenSSH Bug Fix

red hat
Calendar Grey April 10, 2018
Scroller Redhat
The latest OpenSSH release for Fedora bolsters system security through a minor yet effective update, rectifying issues and elevating performance.
An update for openssh is now available for Red Hat Enterprise Linux 7

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

Summary

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.
Security Fix(es):
* openssh: Improper write operations in readonly mode allow for zero-length file creation (CVE-2017-15906)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory security issue access control bug fix Red Hat Enterprise Linux OpenSSH low

References

https://access.redhat.com/security/cve/CVE-2017-15906 https://access.redhat.com/security/updates/classification#low https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/7.5_release_notes/index.html

Package List

Red Hat Enterprise Linux Client (v. 7):
Source: openssh-7.4p1-16.el7.src.rpm
x86_64: openssh-7.4p1-16.el7.x86_64.rpm openssh-askpass-7.4p1-16.el7.x86_64.rpm openssh-clients-7.4p1-16.el7.x86_64.rpm openssh-debuginfo-7.4p1-16.el7.x86_64.rpm openssh-keycat-7.4p1-16.el7.x86_64.rpm openssh-server-7.4p1-16.el7.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64: openssh-cavs-7.4p1-16.el7.x86_64.rpm openssh-debuginfo-7.4p1-16.el7.i686.rpm openssh-debuginfo-7.4p1-16.el7.x86_64.rpm openssh-ldap-7.4p1-16.el7.x86_64.rpm openssh-server-sysvinit-7.4p1-16.el7.x86_64.rpm pam_ssh_agent_auth-0.10.3-2.16.el7.i686.rpm pam_ssh_agent_auth-0.10.3-2.16.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source: openssh-7.4p1-16.el7.src.rpm
x86_64: openssh-7.4p1-16.el7.x86_64.rpm openssh-clients-7.4p1-16.el7.x86_64.rpm openssh-debuginfo-7.4p1-16.el7.x86_64.rpm openssh-keycat-7.4p1-16.el7.x86_64.rpm openssh-server-7.4p1-16.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64: openssh-askpass-7.4p1-16.el7.x86_64.rpm openssh-cavs-7.4p1-16.el7.x86_64.rpm openssh-debuginfo-7.4p1-16.el7.i686.rpm openssh-debuginfo-7.4p1-16.el7.x86_64.rpm openssh-ldap-7.4p1-16.el7.x86_64.rpm openssh-server-sysvinit-7.4p1-16.el7.x86_64.rpm pam_ssh_agent_auth-0.10.3-2.16.el7.i686.rpm

Read the Full Advisory


Severity
low
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2018:0980-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2018:0980
Issue date: 2018-04-10

Topic

An update for openssh is now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Low. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory security issue access control bug fix Red Hat Enterprise Linux OpenSSH low

Relevant Releases Architectures

Red Hat Enterprise Linux Client (v. 7) - x86_64

Red Hat Enterprise Linux Client Optional (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64

Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 7) - x86_64

Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, ppc64le, s390x

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) - aarch64, ppc64le, s390x

Bugs Fixed

1456853 - ssh -Q and -G list host key types that are not allowed in FIPS mode

1478175 - The UseDNS configuration option changed default behaviour between 7.3 and 7.4, this breaks existing configurations until manually corrected

1480510 - SSH connections get closed when time-based rekeyring is used and ClientAliveMaxCount=0

1488083 - segfaults when cleaning up session due to some error

1488982 - GSSAPIStrictAcceptorCheck default change with 7.4

1494268 - pam_ssh_agent_auth SEGV's if keyfile is missing

1496467 - Regression: SSH AuthorizedKeysCommand hangs when output is too large

1496808 - OpenSSH 7.4 doesn't work with WinSCP >= 5.10 clients

1506630 - CVE-2017-15906 openssh: Improper write operations in readonly mode allow for zero-length file creation

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.