This update for openssh fixes the following issues :

CVE-2020-14145: Fixed an observable discrepancy leading to an information leak in the algorithm negotiation (bsc#1173513).

Fixed an issue where AuthorizedKeysCommand produced a lot of output (bsc#1161684).

Fixed an issue where oracle cluster with cluvfy using 'scp' failing/missinterpreted (bsc#1148566).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).

Fixed an issue where oracle cluster with cluvfy using 'scp' failing/missinterpreted (bsc#1148566).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 16.1.4 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K48050136 advisory.

    The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in     the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts     (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and     8.6 are also affected.(CVE-2020-14145)ImpactSSH sessions may be vulnerable to a man-in-the-middle attack.

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4368 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: Observable discrepancy leading to an information leak in the algorithm negotiation     (CVE-2020-14145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4368 advisory.

    - CVE-2020-14145 openssh: Observable Discrepancy leading to an information       leak in the algorithm negotiation (#1882252)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202105-35 (OpenSSH: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSH. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, able to access the socket of the forwarding agent,       might be able to execute arbitrary code with the privileges of the       process or cause a Denial of Service condition.
      Furthermore, a remote attacker might conduct a man-in-the-middle attack       targeting initial connection attempts where no host key for the server       has been cached by client yet.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
144351	SUSE SLES12 Security Update : openssh (SUSE-SU-2020:3844-1)	Nessus	SuSE Local Security Checks	2020/12/17	2024/2/1	medium
144501	SUSE SLES15 Security Update : openssh (SUSE-SU-2020:3882-1)	Nessus	SuSE Local Security Checks	2020/12/21	2024/1/31	medium
144037	SUSE SLED15 / SLES15 Security Update : openssh (SUSE-SU-2020:3736-1)	Nessus	SuSE Local Security Checks	2020/12/10	2024/2/2	medium
166567	F5 Networks BIG-IP : OpenSSH client vulnerability (K48050136)	Nessus	F5 Networks Local Security Checks	2022/10/26	2025/3/27	medium
155126	RHEL 8 : openssh (RHSA-2021:4368)	Nessus	Red Hat Local Security Checks	2021/11/11	2024/11/7	medium
155394	Oracle Linux 8 : openssh (ELSA-2021-4368)	Nessus	Oracle Linux Local Security Checks	2021/11/17	2024/10/23	medium
157020	GLSA-202105-35 : OpenSSH: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2022/1/24	2022/1/26	high

检测

插件搜索

medium

medium

medium

medium

medium

medium

high