This update for openssh fixes the following issues :

Security vulnerabilities addressed :

CVE-2019-6109: Fixed an character encoding issue in the progress display of the scp client that could be used to manipulate client output, allowing for spoofing during file transfers (bsc#1121816)

CVE-2019-6111: Properly validate object names received by the scp client to prevent arbitrary file overwrites when interacting with a malicious SSH server (bsc#1121821)

Other bug fixes and changes: Handle brace expansion in scp when checking that filenames sent by the server side match what the client requested (bsc#1125687)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

Security vulnerabilities addressed :

  - CVE-2019-6109: Fixed an character encoding issue in the     progress display of the scp client that could be used to     manipulate client output, allowing for spoofing during     file transfers (bsc#1121816)

  - CVE-2019-6111: Properly validate object names received     by the scp client to prevent arbitrary file overwrites     when interacting with a malicious SSH server     (bsc#1121821)

Other bug fixes and changes :

  - Handle brace expansion in scp when checking that     filenames sent by the server side match what the client     requested (bsc#1125687)

This update was imported from the SUSE:SLE-15:Update update project.

This update for openssh fixes the following issues :

Security vulnerabilities addressed :

CVE-2019-6109: Fixed an character encoding issue in the progress display of the scp client that could be used to manipulate client output, allowing for spoofing during file transfers (bsc#1121816).

CVE-2019-6111: Properly validate object names received by the scp client to prevent arbitrary file overwrites when interacting with a malicious SSH server (bsc#1121821).

Other issues fixed: Fixed two race conditions in sshd relating to SIGHUP (bsc#1119183).

Returned proper reason for port forwarding failures (bsc#1090671).

Fixed SSHD termination of multichannel sessions with non-root users (bsc#1115550).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Remotely observable behaviour in auth-gss2.c in OpenSSH     through 7.8 could be used by remote attackers to detect     existence of users on a target system when GSS2 is in     use. NOTE: the discoverer states 'We understand that     the OpenSSH developers do not want to treat such a     username enumeration (or 'oracle') as a     vulnerability.'(CVE-2018-15919)

  - An issue was discovered in OpenSSH 7.9. Due to missing     character encoding in the progress display, a malicious     server (or Man-in-The-Middle attacker) can employ     crafted object names to manipulate the client output,     e.g., by using ANSI control codes to hide additional     files being transferred. This affects     refresh_progress_meter() in     progressmeter.c.(CVE-2019-6109)

  - An issue was discovered in OpenSSH 7.9. Due to the scp     implementation being derived from 1983 rcp, the server     chooses which files/directories are sent to the client.
    However, the scp client only performs cursory     validation of the object name returned (only directory     traversal attacks are prevented). A malicious scp     server (or Man-in-The-Middle attacker) can overwrite     arbitrary files in the scp client target directory. If     recursive operation (-r) is performed, the server can     manipulate subdirectories as well (for example, to     overwrite the .ssh/authorized_keys     file).(CVE-2019-6111)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 7.1.26 or 8.0.x prior to 8.0.21 or 8.1.x prior to 8.1.13 or 9.0.x prior to 9.0.7. It is, therefore, affected by  multiple vulnerabilities.

  - OpenSSH software included with PAN-OS has been upgraded to resolve multiple vulnerabilities.
    (CVE-2018-20685, CVE-2019-6109, CVE-2019-6111)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
122473	SUSE SLED15 / SLES15 Security Update : openssh (SUSE-SU-2019:0496-1)	Nessus	SuSE Local Security Checks	2019/2/27	2022/5/23	medium
122743	openSUSE Security Update : openssh (openSUSE-2019-307)	Nessus	SuSE Local Security Checks	2019/3/11	2024/6/14	medium
124057	SUSE SLES12 Security Update : openssh (SUSE-SU-2019:0941-1)	Nessus	SuSE Local Security Checks	2019/4/15	2022/5/20	medium
135548	EulerOS 2.0 SP3 : openssh (EulerOS-SA-2020-1419)	Nessus	Huawei Local Security Checks	2020/4/15	2022/5/13	medium
148123	Palo Alto Networks PAN-OS 7.1.x < 7.1.26 / 8.0.x < 8.0.21 / 8.1.x < 8.1.13 / 9.0.x < 9.0.7 Multiple Vulnerabilities	Nessus	Palo Alto Local Security Checks	2021/3/25	2022/5/10	medium

检测

插件搜索

medium

medium

medium

medium

medium