Stay Secure with the Latest Linux Advisories

security advisoryremote code executionimportant

Red Hat Enterprise Linux 6: RHSA-2023:4428-01 Important OpenSSH RCE

An update for openssh is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: openssh security update Advisory ID: RHSA-2023:4428-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:4428 Issue date: 2023-08-02 CVE Names: CVE-2023-38408 ===================================================================== 1. Summary: An update for openssh is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server (v. 6 ELS) - i386, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6 ELS) - i386, s390x, x86_64 3. Description: OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: Remote code execution in ssh-agent PKCS#11 support (CVE-2023-38408) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) willbe restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 2224173 - CVE-2023-38408 openssh: Remote code execution in ssh-agent PKCS#11 support 6. Package List: Red Hat Enterprise Linux Server (v. 6 ELS): Source: openssh-5.3p1-125.el6_10.src.rpm i386: openssh-5.3p1-125.el6_10.i686.rpm openssh-askpass-5.3p1-125.el6_10.i686.rpm openssh-clients-5.3p1-125.el6_10.i686.rpm openssh-debuginfo-5.3p1-125.el6_10.i686.rpm openssh-server-5.3p1-125.el6_10.i686.rpm s390x: openssh-5.3p1-125.el6_10.s390x.rpm openssh-askpass-5.3p1-125.el6_10.s390x.rpm openssh-clients-5.3p1-125.el6_10.s390x.rpm openssh-debuginfo-5.3p1-125.el6_10.s390x.rpm openssh-server-5.3p1-125.el6_10.s390x.rpm x86_64: openssh-5.3p1-125.el6_10.x86_64.rpm openssh-askpass-5.3p1-125.el6_10.x86_64.rpm openssh-clients-5.3p1-125.el6_10.x86_64.rpm openssh-debuginfo-5.3p1-125.el6_10.x86_64.rpm openssh-server-5.3p1-125.el6_10.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6 ELS): i386: openssh-debuginfo-5.3p1-125.el6_10.i686.rpm openssh-ldap-5.3p1-125.el6_10.i686.rpm pam_ssh_agent_auth-0.9.3-125.el6_10.i686.rpm s390x: openssh-debuginfo-5.3p1-125.el6_10.s390.rpm openssh-debuginfo-5.3p1-125.el6_10.s390x.rpm openssh-ldap-5.3p1-125.el6_10.s390x.rpm pam_ssh_agent_auth-0.9.3-125.el6_10.s390.rpm pam_ssh_agent_auth-0.9.3-125.el6_10.s390x.rpm x86_64: openssh-debuginfo-5.3p1-125.el6_10.i686.rpm openssh-debuginfo-5.3p1-125.el6_10.x86_64.rpm openssh-ldap-5.3p1-125.el6_10.x86_64.rpm pam_ssh_agent_auth-0.9.3-125.el6_10.i686.rpm pam_ssh_agent_auth-0.9.3-125.el6_10.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2023-38408 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGPSIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJkyhHIAAoJENzjgjWX9erEyKQP/3Qfu9Y6bUpoq+STXpRiIRB/ QZ35/gRqOWYX7sqKwdxtXpuVmP2GzSObQCglq9aqY0BXa92xJGJ6aKxize6wC0Rf 1kxZr46Jlgc1irPsPqy2hZCnFBuE+lgEWlKnIKXNQdGp/sF2T4CQeqrSIANZ+rHf vVdbq01idsVoiTcqt8LK/zMkXvRG4z14TkufcZw8nyaGyApmJydALitey1pn9WXF HHrsoUmr8AkhETTitN1a0SX7qVgs8BdlWoWdpY1JWPYiIHSoSbUDOQdcqK5sGZYK 0xkS+QeQmcNeEXESbEz7o1IThXdHiBjM6NhntoDikN1Oc7/SftG5vm8i8C5JQJY7 odbYEFF1BYWlQ1i4ulaZSmybJRvQ5S/WrqzkoXetqoCir/FrJ68RaUi5j/awtkG9 ekOaNH2jAszXCZnAX8VivOht0v/itIYnBsSza2h/kmOHo8MDZqSlrmg4z5rn6Cbw pGXn8sntaE3Us/qvedRLZXzaTYtX9QeUEj/eWuqFTPf8V4PSjTaz44TWKDp0/GQk 2p7inDh0sVQhlkLyvNT0h6aQ0wn2RUASs1RrKefIy7wedX73vUn2EEoeFJTrBjUE Bl04+dTjfjzDQ97MgdoPnAQxTPHH/i4Hz5rVxuya++QnLCCp2uD6ESahB2Gg9gI7 7ZJPejaTEhXGOUdrAylm =VfOr -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Critical patch released for OpenSSH in RHEL 6 to fix severe remote code execution vulnerability; vital for maintaining system security.. OpenSSH Update,RHEL Security Advisory,Critical Security Fix. . Severity: Important. LinuxSecurity.com Team

Aug 02, 2023 •Important Red Hat