CVE-2020-14145
Published: 29 June 2020
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.
Priority
Low
CVSS 3 base score: 5.9
Status
| Package | Release | Status |
|---|---|---|
|
openssh Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
| Ubuntu 21.10 (Impish Indri) |
Needed
|
|
| Ubuntu 21.04 (Hirsute Hippo) |
Needed
|
|
| Ubuntu 20.04 LTS (Focal Fossa) |
Needed
|
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Needed
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Needed
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Needed
|
|
|
Patches: Upstream: https://anongit.mindrot.org/openssh.git/commit/?id=b3855ff053f5078ec3d3c653cdaedefaa5fc362d |
||
|
openssh-ssh1 Launchpad, Ubuntu, Debian |
Upstream |
Ignored
(frozen on openssh 7.5p)
|
| Ubuntu 21.10 (Impish Indri) |
Needed
|
|
| Ubuntu 21.04 (Hirsute Hippo) |
Needed
|
|
| Ubuntu 20.04 LTS (Focal Fossa) |
Needed
|
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Needed
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Does not exist
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
|
|
Notes
| Author | Note |
|---|---|
| seth-arnold | openssh-ssh1 is provided for compatibility with old devices that cannot be upgraded to modern protocols. Thus we may not provide security support for this package if doing so would prevent access to equipment. |
| mdeslaur | Per the advisory, "The developers of OpenSSH are not planning to change the behavior of OpenSSH regarding this issue" We will not be releasing updates for Ubuntu for this issue. On 2020-12-02, it was announced that a partial mitigation has been commited by OpenSSH developers: https://www.openwall.com/lists/oss-security/2020/12/02/1 |
| sbeattie | partial mitigation landed in openssh 8.4p1 |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14145
- https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/
- https://www.fzi.de/fileadmin/user_upload/2020-06-26-FSA-2020-2.pdf
- https://github.com/openssh/openssh-portable/compare/V_8_3_P1...V_8_4_P1
- NVD
- Launchpad
- Debian