Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -3 articles for you...
197
security advisorydebiancritical threatDebian LTS DLA-3794-1 Critical: Putty SSH Threat Remediation
Putty, a Telnet/SSH client for X, was vulnerable. CVE-2019-17069 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3794-1
Apr 25, 2024
•Critical
Debian LTS
197
security advisorydebianauthentication issueDebian LTS: DLA-2860-1 Critical Security Advisory for Paramiko
A couple of vulnerabilites were found in paramiko, an implementation of SSHv2 protocol in Python. CVE-2018-1000805 . - --------------------------------------------------------------------- Debian LTS Advisory DLA-2860-1
Dec 28, 2021
•Critical
Debian LTS
98
security advisorymoderatered hatRed Hat Enterprise Linux 8 Update RHSA-2019-3702-01 Fixes for OpenSSH Bug
An update for openssh is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from . -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: openssh security, bug fix, and enhancement update Advisory ID: RHSA-2019:3702-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:3702 Issue date: 2019-11-05 CVE Names: CVE-2018-20685 CVE-2019-6109 CVE-2019-6111 ==================================================================== 1. Summary: An update for openssh is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. The following packages have been upgraded to a later upstream version: openssh (8.0p1). (BZ#1691045) Security Fix(es): * openssh: scp client improper directory name validation (CVE-2018-20685) * openssh: Improper validation of object names allows malicious server to overwrite files via scp client (CVE-2019-6111) * openssh: Missing character encoding in progress display allows for spoofing of scpclient output (CVE-2019-6109) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1665785 - CVE-2018-20685 openssh: scp client improper directory name validation 1666119 - CVE-2019-6109 openssh: Missing character encoding in progress display allows for spoofing of scp client output 1666127 - CVE-2019-6111 openssh: Improper validation of object names allows malicious server to overwrite files via scp client 1667519 - ssh-copy-id hangs when the remote system is out of space 1668325 - openssh - man pages do not mention crypto-policies 1683295 - Kerberos cleanup procedures do not work with GSSAPIDelegateCredentials and default ccache from krb5.conf 1685096 - In FIPS mode, during DH group exchange, OpenSSH client should validate the received moduli, making sure it is one of the known groups. 1686065 - SSH connections get closed when time-based rekeyring is used and ClientAliveMaxCount=0 1691045 - Rebase OpenSSH to latest release (8.0p1?) 1707485 - Use high-level API to do signatures 1712436 - MD5 is used when writing password protected PEM 1732424 - ssh-keygen -A fails in FIPS mode because of DSA key 1732449 - rsa-sha2-*
Nov 05, 2019
Red Hat
100
security advisorymoderatefile overwriteSUSE: 2019:14030-1 Moderate: OpenSSH File Overwrite Threat
An update that solves two vulnerabilities and has four fixes is now available. . SUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: SUSE-SU-2019:14030-1 Rating: moderate References: #1090671 #1115550 #1119183 #1121816 #1121821 #1131709 Cross-References: CVE-2019-6109 CVE-2019-6111 Affected Products: SUSE Linux Enterprise Server 11-SP4-LTSS SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves two vulnerabilities and has four fixes is now available. Description: This update for openssh fixes the following issues: Security vulnerabilities addressed: - CVE-2019-6109: Fixed an character encoding issue in the progress display of the scp client that could be used to manipulate client output, allowing for spoofing during file transfers (bsc#1121816). - CVE-2019-6111: Properly validate object names received by the scp client to prevent arbitrary file overwrites when interacting with a malicious SSH server (bsc#1121821). Other issues fixed: - Fixed two race conditions in sshd relating to SIGHUP (bsc#1119183). - Returned proper reason for port forwarding failures (bsc#1090671). - Fixed SSHD termination of multichannel sessions with non-root users (bsc#1115550). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4-LTSS: zypper in -t patch slessp4-openssh-14030=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-openssh-14030=1 Package List: - SUSE Linux Enterprise Server 11-SP4-LTSS (i586 ppc64 s390x x86_64): openssh-6.6p1-36.20.1 openssh-askpass-gnome-6.6p1-36.20.1 openssh-fips-6.6p1-36.20.1 openssh-helpers-6.6p1-36.20.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ppc64 s390x x86_64): openssh-askpass-gnome-debuginfo-6.6p1-36.20.1 openssh-debuginfo-6.6p1-36.20.1 openssh-debugsource-6.6p1-36.20.1 References: https://www.suse.com/security/cve/CVE-2019-6109.html https://www.suse.com/security/cve/CVE-2019-6111.html https://bugzilla.suse.com/1090671 https://bugzilla.suse.com/1115550 https://bugzilla.suse.com/1119183 https://bugzilla.suse.com/1121816 https://bugzilla.suse.com/1121821 https://bugzilla.suse.com/1131709 _______________________________________________ sle-security-updates mailing list
Apr 25, 2019
SuSE
87
security advisorycriticaldebianDebian Wheezy: DSA-3190-1 Critical: Putty Memory Leak Exponential Issue
Patrick Coleman discovered that the Putty SSH client failed to wipe out unused sensitive memory. In addition Florent Daigniere discovered that exponential values in . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3190-1
Mar 15, 2015
•Critical
Debian
91
security advisorysecurity issuegentooGentoo GLSA-201308-01 Normal: Putty Security Threats and Fixes
Multiple vulnerabilities have been found in Putty, allowing attackers to compromise user system. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201308-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: PuTTY: Multiple Vulnerabilities Date: August 21, 2013 Bugs: #394429, #479872 ID: 201308-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in Putty, allowing attackersto compromise user system Background ========= PuTTY is a telnet and SSH client. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/putty < 0.63 > = 0.63 Description ========== Multiple vulnerabilities have been discovered in PuTTY. Please review the CVE identifiers referenced below for details. Impact ===== An attacker could entice a user to open connection to specially crafted SSH server, possibly resulting in execution of arbitrary code with the privileges of the process or obtain sensitive information. Workaround ========= There is no known workaround at this time. Resolution ========= All PuTTY users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =net-misc/putty-0.63" References ========= [ 1 ] CVE-2011-4607 http://nvd.nist.gov/nvd.cvm?cvename=CVE-2011-4607 [ 2 ] CVE-2013-4852 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4852 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201308-01 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Aug 21, 2013
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!