USN-3809-2: OpenSSH regression | Cloud Foundry

Severity

Unknown

Vendor

Canonical Ubuntu

Versions Affected

• Canonical Ubuntu 18.04

Description

USN-3809-1 fixed vulnerabilities in OpenSSH. The update for CVE-2018-15473 was incomplete and could introduce a regression in certain environments. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Robert Swiecki discovered that OpenSSH incorrectly handled certain messages. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-10708)

It was discovered that OpenSSH incorrectly handled certain requests. An attacker could possibly use this issue to access sensitive information. (CVE-2018-15473)

Affected Cloud Foundry Products and Versions

Severity is unknown unless otherwise noted.

• Bionic Stemcells
  • 1.x versions prior to 1.24
  • All other stemcells not listed.
• cflinuxfs3
  • All versions prior to 0.252.0
• CF Deployment
  • All versions prior to 16.23.0

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• Bionic Stemcells
  • Upgrade 1.x versions to 1.24 or greater
  • All other stemcells should be upgraded to the latest version available on bosh.io.
• cflinuxfs3
  • Upgrade all versions to 0.252.0 or greater
• CF Deployment
  • Upgrade all versions to 16.23.0 or greater

References

• USN Notice

History

2021-09-07: Initial vulnerability report published.