CVE-2020-14145
Published: 29 June 2020
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.
Priority
Low
CVSS 3 base score: 5.9
Status
| Package | Release | Status |
|---|---|---|
|
openssh Launchpad, Ubuntu, Debian |
bionic |
Needed
|
| eoan |
Ignored
(reached end-of-life)
|
|
| focal |
Needed
|
|
| groovy |
Ignored
(reached end-of-life)
|
|
| hirsute |
Ignored
(reached end-of-life)
|
|
| impish |
Needed
|
|
| jammy |
Needed
|
|
| precise |
Ignored
(end of ESM support, was needed)
|
|
| trusty |
Needed
|
|
| upstream |
Needs triage
|
|
| xenial |
Needed
|
|
|
openssh-ssh1 Launchpad, Ubuntu, Debian |
bionic |
Needed
|
| eoan |
Ignored
(reached end-of-life)
|
|
| focal |
Needed
|
|
| groovy |
Ignored
(reached end-of-life)
|
|
| hirsute |
Ignored
(reached end-of-life)
|
|
| impish |
Needed
|
|
| jammy |
Needed
|
|
| precise |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Ignored
(frozen on openssh 7.5p)
|
|
| xenial |
Does not exist
|
Notes
| Author | Note |
|---|---|
| seth-arnold | openssh-ssh1 is provided for compatibility with old devices that cannot be upgraded to modern protocols. Thus we may not provide security support for this package if doing so would prevent access to equipment. |
| mdeslaur | Per the advisory, "The developers of OpenSSH are not planning to change the behavior of OpenSSH regarding this issue" We will not be releasing updates for Ubuntu for this issue. On 2020-12-02, it was announced that a partial mitigation has been commited by OpenSSH developers: https://www.openwall.com/lists/oss-security/2020/12/02/1 |
| sbeattie | partial mitigation landed in openssh 8.4p1 |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14145
- https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/
- https://www.fzi.de/fileadmin/user_upload/2020-06-26-FSA-2020-2.pdf
- https://github.com/openssh/openssh-portable/compare/V_8_3_P1...V_8_4_P1
- NVD
- Launchpad
- Debian