USN-3885-1: OpenSSH vulnerabilities
Harry Sintonen discovered multiple issues in the OpenSSH scp utility. If a user or automated system were tricked into connecting to an untrusted server, a remote attacker could possibly use these issues to write to arbitrary files, change directory permissions, and spoof client output.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/openssh-clientto a version that resolves this vulnerability.Fixed in 1:7.7p1-4ubuntu0.2 - Upgrade
Upgrade
ubuntu/openssh-clientto a version that resolves this vulnerability.Fixed in 1:7.6p1-4ubuntu0.2 - Upgrade
Upgrade
ubuntu/openssh-clientto a version that resolves this vulnerability.Fixed in 1:7.2p2-4ubuntu2.7 - Upgrade
Upgrade
ubuntu/openssh-clientto a version that resolves this vulnerability.Fixed in 1:6.6p1-2ubuntu2.12
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is USN-3885-1.
What is the vulnerability title?
The vulnerability title is OpenSSH vulnerabilities.
What are the issues discovered in OpenSSH scp utility?
Multiple issues were discovered in the OpenSSH scp utility.
What is the impact of these issues?
If a user or automated system connects to an untrusted server, a remote attacker could write to arbitrary files, change directory permissions, and spoof client output.
Which software versions are affected?
OpenSSH client versions 7.7p1-4ubuntu0.2, 7.6p1-4ubuntu0.2, 7.2p2-4ubuntu2.7, and 6.6p1-2ubuntu2.12 on Ubuntu 18.10, 18.04, 16.04, and 14.04, respectively.
How can I fix this vulnerability?
Update your OpenSSH client to version 1:7.7p1-4ubuntu0.2 on Ubuntu 18.10, 1:7.6p1-4ubuntu0.2 on Ubuntu 18.04, 1:7.2p2-4ubuntu2.7 on Ubuntu 16.04, and 1:6.6p1-2ubuntu2.12 on Ubuntu 14.04.
Where can I find more information about this vulnerability?
More information about this vulnerability can be found at the following references: 1. [CVE-2018-20685](https://ubuntu.com/security/CVE-2018-20685) 2. [CVE-2019-6109](https://ubuntu.com/security/CVE-2019-6109) 3. [CVE-2019-6111](https://ubuntu.com/security/CVE-2019-6111)