USN-6242-1: OpenSSH vulnerability

Releases

• Ubuntu 23.04
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• openssh - secure shell (SSH) for secure access to remote machines

Details

It was discovered that OpenSSH incorrectly handled loading certain PKCS#11
providers. If a user forwarded their ssh-agent to an untrusted system, a
remote attacker could possibly use this issue to load arbitrary libraries
from the user's system and execute arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.04

• openssh-client - 1:9.0p1-1ubuntu8.4

Ubuntu 22.04

• openssh-client - 1:8.9p1-3ubuntu0.3

Ubuntu 20.04

• openssh-client - 1:8.2p1-4ubuntu0.8

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-38408

Related notices

• USN-6242-2: openssh-client-ssh1, openssh-sftp-server, openssh, openssh-client, ssh-krb5, openssh-server, ssh, ssh-askpass-gnome