SUSE-SU-2024:0603-1: Security update for openssh

Q: What input must an attacker control to exploit this issue?

The issue involves command injection through metacharacters in a user name or host name. An attacker would need a way to cause OpenSSH to process a user name or host name containing those metacharacters.

Q: Which SUSE packages are covered by this update?

The update covers openssh, openssh-fips, openssh-helpers, openssh-askpass-gnome, and the listed debuginfo and debugsource packages.

Q: How can I determine whether my system needs this update?

Check whether any of the affected SUSE OpenSSH packages are installed and whether the security update SUSE-SU-2024:0603-1 has been applied. The advisory identifies CVE-2023-51385 as the issue fixed by the update.

Published Feb 23, 2024

Updated

This update for openssh fixes the following issues: CVE-2023-51385: Fixed command injection via user name or host name metacharacters (bsc#1218215).

Affected Software

29 affected componentsFixes available

All of the following

SUSE SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64)

Any of the following

suse/openssh-askpass-gnome-debugsource<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-askpass-gnome-debuginfo<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-debuginfo<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-fips<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-askpass-gnome<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-helpers<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-helpers-debuginfo<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-debugsource<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

All of the following

SUSE SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/openssh-askpass-gnome-debugsource<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-askpass-gnome-debuginfo<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-debuginfo<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-fips<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-askpass-gnome<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-helpers<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-helpers-debuginfo<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-debugsource<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

Any of the following

suse/openssh-askpass-gnome-debugsource<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-askpass-gnome-debuginfo<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-debuginfo<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-fips<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-askpass-gnome<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-helpers<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-helpers-debuginfo<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

suse/openssh-debugsource<8.1p1-150200.5.46.1

8.1p1-150200.5.46.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/openssh-askpass-gnome-debugsource to a version that resolves this vulnerability.
Fixed in 8.1p1-150200.5.46.1
Upgrade
Upgrade suse/openssh-askpass-gnome-debuginfo to a version that resolves this vulnerability.
Fixed in 8.1p1-150200.5.46.1
Upgrade
Upgrade suse/openssh-debuginfo to a version that resolves this vulnerability.
Fixed in 8.1p1-150200.5.46.1
Upgrade
Upgrade suse/openssh-fips to a version that resolves this vulnerability.
Fixed in 8.1p1-150200.5.46.1
Upgrade
Upgrade suse/openssh-askpass-gnome to a version that resolves this vulnerability.
Fixed in 8.1p1-150200.5.46.1
Upgrade
Upgrade suse/openssh to a version that resolves this vulnerability.
Fixed in 8.1p1-150200.5.46.1
Upgrade
Upgrade suse/openssh-helpers to a version that resolves this vulnerability.
Fixed in 8.1p1-150200.5.46.1
Upgrade
Upgrade suse/openssh-helpers-debuginfo to a version that resolves this vulnerability.
Fixed in 8.1p1-150200.5.46.1
Upgrade
Upgrade suse/openssh-debugsource to a version that resolves this vulnerability.
Fixed in 8.1p1-150200.5.46.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-603=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-603=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-603=1

Event History

Feb 23, 2024

Advisory Published

via SUSE·12:30 PM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2023-51385

Frequently Asked Questions

What input must an attacker control to exploit this issue?

The issue involves command injection through metacharacters in a user name or host name. An attacker would need a way to cause OpenSSH to process a user name or host name containing those metacharacters.

Which SUSE packages are covered by this update?

The update covers openssh, openssh-fips, openssh-helpers, openssh-askpass-gnome, and the listed debuginfo and debugsource packages.

How can I determine whether my system needs this update?

Check whether any of the affected SUSE OpenSSH packages are installed and whether the security update SUSE-SU-2024:0603-1 has been applied. The advisory identifies CVE-2023-51385 as the issue fixed by the update.

SUSE-SU-2024:0603-1: Security update for openssh

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What input must an attacker control to exploit this issue?

Which SUSE packages are covered by this update?

How can I determine whether my system needs this update?

Company

Resources

Contact

Frequently Asked Questions

What input must an attacker control to exploit this issue?

Which SUSE packages are covered by this update?

How can I determine whether my system needs this update?