CVE-2023-5616

Published: 13 December 2023

In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user.

From the Ubuntu Security Team

Zygmunt Krynicki discovered that GNOME Settings did not accurately reflect the SSH remote login status when the system was configured to use systemd socket activation for OpenSSH. Remote SSH access may be unknowingly enabled, contrary to expectation.

Notes

systemd socket activation is only used by default for
openssh-server since Ubuntu 22.10. Earlier releases would only be affected
if the local system administrator had manually configured the system to
use systemd socket activation. As such this issue is considered low priority
on Ubuntu releases before 22.10.

Status

References

• https://ubuntu.com/security/notices/USN-6554-1
• https://www.cve.org/CVERecord?id=CVE-2023-5616
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.launchpad.net/ubuntu/+source/gnome-control-center/+bug/2039577