Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 515
Alerts This Week
Warning Icon 1 515

SUSE: 2020:3866-1 Moderate: OpenSSH Information Leak Fix

suse
Calendar Grey December 17, 2020
Scroller Suse
SUSE has released a security update for OpenSSH addressing severe vulnerabilities and gaps, includes detailed patching guidelines. For full security details, refer to the documentation.
An update that solves one vulnerability and has 5 fixes is now available

Summary

This update for openssh fixes the following issues: - CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513). - Supplement libgtk-3-0 instead of libX11-6 to avoid installation on a textmode install (bsc#1142000) - Fixed an issue where oracle cluster with cluvfy using "scp" failing/missinterpreted (bsc#1148566). - Fixed sshd termination of multichannel sessions with non-root users (bsc#1115550,bsc#1174162). - Added speculative hardening for key storage (bsc#1139398). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Server Applications 15-SP1:

Topics%20covered

Topics Covered

security advisory information leak moderate severity SUSE OpenSSH server applications desktop applications

References

#1115550 #1139398 #1142000 #1148566 #1173513

#1174162

Cross- CVE-2020-14145

Affected Products:

SUSE Linux Enterprise Module for Server Applications 15-SP1

SUSE Linux Enterprise Module for Desktop Applications 15-SP1

SUSE Linux Enterprise Module for Basesystem 15-SP1

https://www.suse.com/security/cve/CVE-2020-14145.html

https://bugzilla.suse.com/1115550

https://bugzilla.suse.com/1139398

https://bugzilla.suse.com/1142000

https://bugzilla.suse.com/1148566

https://bugzilla.suse.com/1173513

https://bugzilla.suse.com/1174162

Announcement ID: SUSE-SU-2020:3866-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory information leak moderate severity SUSE OpenSSH server applications desktop applications

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.