GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2021:1383-1

Vulnerability from csaf_opensuse - Published: 2021-10-18 14:06 - Updated: 2021-10-18 14:06
Summary
Security update for ssh-audit
Severity
Moderate
Notes
Title of the patch: Security update for ssh-audit
Description of the patch: This update for ssh-audit fixes the following issues: ssh-audit was updated to version 2.5.0 * Fixed crash when running host key tests. * Handles server connection failures more gracefully. * Now prints JSON with indents when -jj is used (useful for debugging). * Added MD5 fingerprints to verbose output. * Added -d/--debug option for getting debugging output. * Updated JSON output to include MD5 fingerprints. Note that this results in a breaking change in the 'fingerprints' dictionary format. * Updated OpenSSH 8.1 (and earlier) policies to include rsa-sha2-512 and rsa-sha2-256. * Added OpenSSH v8.6 & v8.7 policies. * Added 3 new key exchanges: + gss-gex-sha1-eipGX3TCiQSrx573bT1o1Q== + gss-group1-sha1-eipGX3TCiQSrx573bT1o1Q== + gss-group14-sha1-eipGX3TCiQSrx573bT1o1Q== * Added 3 new MACs: + hmac-ripemd160-96 + AEAD_AES_128_GCM + AEAD_AES_256_GCM Update to version 2.4.0 * Added multi-threaded scanning support. * Added version check for OpenSSH user enumeration (CVE-2018-15473). * Added deprecation note to host key types based on SHA-1. * Added extra warnings for SSHv1. * Added built-in hardened OpenSSH v8.5 policy. * Upgraded warnings to failures for host key types based on SHA-1 * Fixed crash when receiving unexpected response during host key test. * Fixed hang against older Cisco devices during host key test & gex test. * Fixed improper termination while scanning multiple targets when one target returns an error. * Dropped support for Python 3.5 (which reached EOL in Sept.2020) * Added 1 new key exchange: sntrup761x25519-sha512@openssh.com. Update to version 2.3.1 * Now parses public key sizes for rsa-sha2-256-cert-v01@openssh.com and rsa-sha2-512-cert-v01@openssh.com host key types. * Flag ssh-rsa-cert-v01@openssh.com as a failure due to SHA-1 hash. * Fixed bug in recommendation output which suppressed some algorithms inappropriately. * Built-in policies now include CA key requirements (if certificates are in use). * Lookup function (--lookup) now performs case-insensitive lookups of similar algorithms. * Migrated pre-made policies from external files to internal database. * Split single 3,500 line script into many files (by class). * Added setup.py support * Added 1 new cipher: des-cbc@ssh.com. Update to version 2.3.0 The highlight of this release is support for policy scanning (this allows an admin to test a server against a hardened/standard configuration). * Added new policy auditing functionality to test adherence to a hardening guide/standard configuration (see -L/--list-policies, -M/--make-policy and -P/--policy). * Created new man page (see ssh-audit.1 file). * 1024-bit moduli upgraded from warnings to failures. * Many Python 2 code clean-ups, testing framework improvements, pylint & flake8 fixes, and mypy type comments. * Added feature to look up algorithms in internal database (see --lookup) * Suppress recommendation of token host key types. * Added check for use-after-free vulnerability in PuTTY v0.73. * Added 11 new host key types: ssh-rsa1, ssh-dss-sha256@ssh.com, ssh-gost2001, ssh-gost2012-256, ssh-gost2012-512, spki-sign-rsa, ssh-ed448, x509v3-ecdsa-sha2-nistp256, x509v3-ecdsa-sha2-nistp384, x509v3-ecdsa-sha2-nistp521, x509v3-rsa2048-sha256. * Added 8 new key exchanges: diffie-hellman-group1-sha256, kexAlgoCurve25519SHA256, Curve25519SHA256, gss-group14-sha256-, gss-group15-sha512-, gss-group16-sha512-, gss-nistp256-sha256-, gss-curve25519-sha256-. * Added 5 new ciphers: blowfish, AEAD_AES_128_GCM, AEAD_AES_256_GCM, crypticore128@ssh.com, seed-cbc@ssh.com. * Added 3 new MACs: chacha20-poly1305@openssh.com, hmac-sha3-224, crypticore-mac@ssh.com. - Update ssh-audit.keyring
Patchnames: openSUSE-2021-1383
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2018-15473
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 15.2:ssh-audit-2.5.0-lp152.2.3.1.noarch —
Vendor Fix
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for ssh-audit",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for ssh-audit fixes the following issues:\n\nssh-audit was updated to version 2.5.0\n\n* Fixed crash when running host key tests.\n* Handles server connection failures more gracefully.\n* Now prints JSON with indents when -jj is used (useful for\n  debugging).\n* Added MD5 fingerprints to verbose output.\n* Added -d/--debug option for getting debugging output.\n* Updated JSON output to include MD5 fingerprints. Note that\n  this results in a breaking change in the \u0027fingerprints\u0027\n  dictionary format.\n* Updated OpenSSH 8.1 (and earlier) policies to include\n  rsa-sha2-512 and rsa-sha2-256.\n* Added OpenSSH v8.6 \u0026 v8.7 policies.\n* Added 3 new key exchanges:\n\n  + gss-gex-sha1-eipGX3TCiQSrx573bT1o1Q==\n  + gss-group1-sha1-eipGX3TCiQSrx573bT1o1Q==\n  + gss-group14-sha1-eipGX3TCiQSrx573bT1o1Q==\n* Added 3 new MACs:\n\n  + hmac-ripemd160-96\n  + AEAD_AES_128_GCM\n  + AEAD_AES_256_GCM\n\nUpdate to version 2.4.0\n\n* Added multi-threaded scanning support.\n* Added version check for OpenSSH user enumeration (CVE-2018-15473).\n* Added deprecation note to host key types based on SHA-1.\n* Added extra warnings for SSHv1.\n* Added built-in hardened OpenSSH v8.5 policy.\n* Upgraded warnings to failures for host key types based on SHA-1\n* Fixed crash when receiving unexpected response during host key\n  test.\n* Fixed hang against older Cisco devices during host key test \u0026\n  gex test.\n* Fixed improper termination while scanning multiple targets when\n  one target returns an error.\n* Dropped support for Python 3.5 (which reached EOL in Sept.2020)\n* Added 1 new key exchange: sntrup761x25519-sha512@openssh.com.\n\nUpdate to version 2.3.1\n\n* Now parses public key sizes for\n  rsa-sha2-256-cert-v01@openssh.com and\n  rsa-sha2-512-cert-v01@openssh.com host key types.\n* Flag ssh-rsa-cert-v01@openssh.com as a failure due to SHA-1\n  hash.\n* Fixed bug in recommendation output which suppressed some\n  algorithms inappropriately.\n* Built-in policies now include CA key requirements (if\n  certificates are in use).\n* Lookup function (--lookup) now performs case-insensitive\n  lookups of similar algorithms.\n* Migrated pre-made policies from external files to internal\n  database.\n* Split single 3,500 line script into many files (by class).\n* Added setup.py support\n* Added 1 new cipher: des-cbc@ssh.com.\n\nUpdate to version 2.3.0\n\nThe highlight of this release is support for policy scanning\n(this allows an admin to test a server against a\nhardened/standard configuration).\n\n* Added new policy auditing functionality to test adherence to\n  a hardening guide/standard configuration\n  (see -L/--list-policies, -M/--make-policy and -P/--policy).\n* Created new man page (see ssh-audit.1 file).\n* 1024-bit moduli upgraded from warnings to failures.\n* Many Python 2 code clean-ups, testing framework improvements,\n  pylint \u0026 flake8 fixes, and mypy type comments.\n* Added feature to look up algorithms in internal database\n  (see --lookup)\n* Suppress recommendation of token host key types.\n* Added check for use-after-free vulnerability in PuTTY v0.73.\n* Added 11 new host key types: ssh-rsa1, ssh-dss-sha256@ssh.com,\n  ssh-gost2001, ssh-gost2012-256, ssh-gost2012-512,\n  spki-sign-rsa, ssh-ed448, x509v3-ecdsa-sha2-nistp256,\n  x509v3-ecdsa-sha2-nistp384, x509v3-ecdsa-sha2-nistp521,\n  x509v3-rsa2048-sha256.\n* Added 8 new key exchanges: diffie-hellman-group1-sha256,\n  kexAlgoCurve25519SHA256, Curve25519SHA256, gss-group14-sha256-,\n  gss-group15-sha512-, gss-group16-sha512-, gss-nistp256-sha256-,\n  gss-curve25519-sha256-.\n* Added 5 new ciphers: blowfish, AEAD_AES_128_GCM,\n  AEAD_AES_256_GCM, crypticore128@ssh.com, seed-cbc@ssh.com.\n* Added 3 new MACs: chacha20-poly1305@openssh.com, hmac-sha3-224,\n  crypticore-mac@ssh.com.\n- Update ssh-audit.keyring\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2021-1383",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_1383-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:1383-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HMNIMCAHIBHI4ABCI2JE3E6E2SYDAP2T/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:1383-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HMNIMCAHIBHI4ABCI2JE3E6E2SYDAP2T/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-15473 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-15473/"
      }
    ],
    "title": "Security update for ssh-audit",
    "tracking": {
      "current_release_date": "2021-10-18T14:06:46Z",
      "generator": {
        "date": "2021-10-18T14:06:46Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:1383-1",
      "initial_release_date": "2021-10-18T14:06:46Z",
      "revision_history": [
        {
          "date": "2021-10-18T14:06:46Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ssh-audit-2.5.0-lp152.2.3.1.noarch",
                "product": {
                  "name": "ssh-audit-2.5.0-lp152.2.3.1.noarch",
                  "product_id": "ssh-audit-2.5.0-lp152.2.3.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ssh-audit-2.5.0-lp152.2.3.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:ssh-audit-2.5.0-lp152.2.3.1.noarch"
        },
        "product_reference": "ssh-audit-2.5.0-lp152.2.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-15473",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-15473"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:ssh-audit-2.5.0-lp152.2.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-15473",
          "url": "https://www.suse.com/security/cve/CVE-2018-15473"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1105010 for CVE-2018-15473",
          "url": "https://bugzilla.suse.com/1105010"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1106163 for CVE-2018-15473",
          "url": "https://bugzilla.suse.com/1106163"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1123133 for CVE-2018-15473",
          "url": "https://bugzilla.suse.com/1123133"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1138392 for CVE-2018-15473",
          "url": "https://bugzilla.suse.com/1138392"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1205621 for CVE-2018-15473",
          "url": "https://bugzilla.suse.com/1205621"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:ssh-audit-2.5.0-lp152.2.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:ssh-audit-2.5.0-lp152.2.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-10-18T14:06:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-15473"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.