USN-3885-1: OpenSSH vulnerabilities

Reference Links

• https://ubuntu.com/security/CVE-2018-20685
• https://ubuntu.com/security/CVE-2019-6109
• https://ubuntu.com/security/CVE-2019-6111
• https://ubuntu.com/security/notices/USN-3885-2
• https://launchpad.net/ubuntu/+source/openssh/1:7.7p1-4ubuntu0.2
• https://launchpad.net/ubuntu/+source/openssh/1:7.6p1-4ubuntu0.2
• https://launchpad.net/ubuntu/+source/openssh/1:7.2p2-4ubuntu2.7
• https://launchpad.net/ubuntu/+source/openssh/1:6.6p1-2ubuntu2.12
• https://ubuntu.com/security/notices/USN-3885-1 (Advisory)

Child vulnerabilities

(Contains the following vulnerabilities)

• CVE-2018-20685
• CVE-2019-6109
• CVE-2019-6111

Frequently Asked Questions

• What is the vulnerability ID?

  The vulnerability ID is USN-3885-1.

• What is the vulnerability title?

  The vulnerability title is OpenSSH vulnerabilities.

• What are the issues discovered in OpenSSH scp utility?

  Multiple issues were discovered in the OpenSSH scp utility.

• What is the impact of these issues?

  If a user or automated system connects to an untrusted server, a remote attacker could write to arbitrary files, change directory permissions, and spoof client output.

• Which software versions are affected?

  OpenSSH client versions 7.7p1-4ubuntu0.2, 7.6p1-4ubuntu0.2, 7.2p2-4ubuntu2.7, and 6.6p1-2ubuntu2.12 on Ubuntu 18.10, 18.04, 16.04, and 14.04, respectively.

• How can I fix this vulnerability?

  Update your OpenSSH client to version 1:7.7p1-4ubuntu0.2 on Ubuntu 18.10, 1:7.6p1-4ubuntu0.2 on Ubuntu 18.04, 1:7.2p2-4ubuntu2.7 on Ubuntu 16.04, and 1:6.6p1-2ubuntu2.12 on Ubuntu 14.04.

• Where can I find more information about this vulnerability?

  More information about this vulnerability can be found at the following references: 1. [CVE-2018-20685](https://ubuntu.com/security/CVE-2018-20685) 2. [CVE-2019-6109](https://ubuntu.com/security/CVE-2019-6109) 3. [CVE-2019-6111](https://ubuntu.com/security/CVE-2019-6111)