Cloud Foundry Logo
blog single gear
Security Advisory

USN-3809-2: OpenSSH regression

Severity

Unknown

Vendor

Canonical Ubuntu

Versions Affected

  • Canonical Ubuntu 18.04

Description

USN-3809-1 fixed vulnerabilities in OpenSSH. The update for CVE-2018-15473 was incomplete and could introduce a regression in certain environments. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Robert Swiecki discovered that OpenSSH incorrectly handled certain messages. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-10708)

It was discovered that OpenSSH incorrectly handled certain requests. An attacker could possibly use this issue to access sensitive information. (CVE-2018-15473)

Affected Cloud Foundry Products and Versions

Severity is unknown unless otherwise noted.

  • Bionic Stemcells
    • 1.x versions prior to 1.24
    • All other stemcells not listed.
  • cflinuxfs3
    • All versions prior to 0.252.0
  • CF Deployment
    • All versions prior to 16.23.0

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

  • Bionic Stemcells
    • Upgrade 1.x versions to 1.24 or greater
    • All other stemcells should be upgraded to the latest version available onĀ bosh.io.
  • cflinuxfs3
    • Upgrade all versions to 0.252.0 or greater
  • CF Deployment
    • Upgrade all versions to 16.23.0 or greater

References

History

2021-09-07: Initial vulnerability report published.

Cloud Foundry Foundation Security Team Profile Image

Cloud Foundry Foundation Security Team, AUTHOR

SEE ALL ARTICLES