UBUNTU-CVE-2020-9355: Critical severity ubuntu/network-manager-ssh vulnerability
Published Feb 23, 2020
·Updated
danfruehauf NetworkManager-ssh before 1.2.11 allows privilege escalation because extra options are mishandled.
Affected Software
2 affected componentsFixes available
ubuntu/network-manager-ssh*
ubuntu/network-manager-ssh<1.2.6-1ubuntu0.1~esm1
1.2.6-1ubuntu0.1~esm1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/network-manager-sshto a version that resolves this vulnerability.Fixed in 1.2.6-1ubuntu0.1~esm1
Event History
Feb 23, 2020
CVE Published
via OSV·02:15 AM
Data Sourced
via OSV·02:15 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which installations are affected?
Ubuntu installations using the danfruehauf NetworkManager-ssh package are affected if the installed version is earlier than 1.2.11.
2
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.
3
What is the potential impact?
Successful exploitation can lead to privilege escalation with high impact to confidentiality, integrity, and availability.