CVE-2020-14145
Published: 29 June 2020
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.
Notes
| Author | Note |
|---|---|
| seth-arnold | openssh-ssh1 is provided for compatibility with old devices that cannot be upgraded to modern protocols. Thus we may not provide security support for this package if doing so would prevent access to equipment. |
| mdeslaur | Per the advisory, "The developers of OpenSSH are not planning to change the behavior of OpenSSH regarding this issue" We will not be releasing updates for Ubuntu for this issue. On 2020-12-02, it was announced that a partial mitigation has been commited by OpenSSH developers: https://www.openwall.com/lists/oss-security/2020/12/02/1 |
| sbeattie | partial mitigation landed in openssh 8.4p1 |
| litios | OpenSSH cannot be patch to fully mitigate this CVE as patching it would disable the reordering of host key algorithms, breaking RFC 4253. The partial mitigation disables this reordering only in a single specific situation. Marking as deferred. |
| ccdm94 | patching this issue in trusty and xenial has been considered risky. Therefore, these releases will be marked as ignored. |
Priority
Low
CVSS 3 base score: 5.9
Status
| Package | Release | Status |
|---|---|---|
|
openssh Launchpad, Ubuntu, Debian |
bionic |
Deferred
|
| eoan |
Ignored
(reached end-of-life)
|
|
| focal |
Deferred
|
|
| groovy |
Ignored
(reached end-of-life)
|
|
| hirsute |
Ignored
(reached end-of-life)
|
|
| impish |
Ignored
(reached end-of-life)
|
|
| jammy |
Deferred
|
|
| kinetic |
Deferred
|
|
| precise |
Ignored
(end of ESM support, was needed)
|
|
| trusty |
Ignored
(see notes)
|
|
| upstream |
Deferred
|
|
| xenial |
Ignored
(see notes)
|
|
|
Patches: upstream: https://anongit.mindrot.org/openssh.git/commit/?id=b3855ff053f5078ec3d3c653cdaedefaa5fc362d |
||
|
openssh-ssh1 Launchpad, Ubuntu, Debian |
bionic |
Deferred
|
| eoan |
Ignored
(reached end-of-life)
|
|
| focal |
Deferred
|
|
| groovy |
Ignored
(reached end-of-life)
|
|
| hirsute |
Ignored
(reached end-of-life)
|
|
| impish |
Ignored
(reached end-of-life)
|
|
| jammy |
Deferred
|
|
| kinetic |
Deferred
|
|
| precise |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Ignored
(frozen on openssh 7.5p)
|
|
| xenial |
Does not exist
|
|
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14145
- https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/
- https://www.fzi.de/fileadmin/user_upload/2020-06-26-FSA-2020-2.pdf
- https://github.com/openssh/openssh-portable/compare/V_8_3_P1...V_8_4_P1
- NVD
- Launchpad
- Debian