Security update for openssh SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:0496-1 Final 1 1 2019-02-26T15:43:14Z current 2019-02-26T15:43:14Z 2019-02-26T15:43:14Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssh This update for openssh fixes the following issues: Security vulnerabilities addressed: - CVE-2019-6109: Fixed an character encoding issue in the progress display of the scp client that could be used to manipulate client output, allowing for spoofing during file transfers (bsc#1121816) - CVE-2019-6111: Properly validate object names received by the scp client to prevent arbitrary file overwrites when interacting with a malicious SSH server (bsc#1121821) Other bug fixes and changes: - Handle brace expansion in scp when checking that filenames sent by the server side match what the client requested (bsc#1125687) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-Azure-BYOS-2019-496,Image SLES15-EC2-CHOST-HVM-BYOS-2019-496,Image SLES15-EC2-HVM-BYOS-2019-496,Image SLES15-GCE-BYOS-2019-496,Image SLES15-OCI-BYOS-2019-496,Image SLES15-SAP-Azure-2019-496,Image SLES15-SAP-Azure-BYOS-2019-496,Image SLES15-SAP-Azure-LI-BYOS-Production-2019-496,Image SLES15-SAP-Azure-VLI-BYOS-Production-2019-496,Image SLES15-SAP-EC2-HVM-2019-496,Image SLES15-SAP-EC2-HVM-BYOS-2019-496,Image SLES15-SAP-GCE-2019-496,Image SLES15-SAP-GCE-BYOS-2019-496,Image SLES15-SAP-OCI-BYOS-2019-496,SUSE-2019-496,SUSE-SLE-Module-Basesystem-15-2019-496,SUSE-SLE-Module-Desktop-Applications-15-2019-496,SUSE-SLE-Module-Development-Tools-OBS-15-2019-496,SUSE-SLE-Module-Server-Applications-15-2019-496 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20190496-1/ Link for SUSE-SU-2019:0496-1 https://lists.suse.com/pipermail/sle-security-updates/2019-February/005157.html E-Mail link for SUSE-SU-2019:0496-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1121816 SUSE Bug 1121816 https://bugzilla.suse.com/1121821 SUSE Bug 1121821 https://bugzilla.suse.com/1125687 SUSE Bug 1125687 https://www.suse.com/security/cve/CVE-2019-6109/ SUSE CVE CVE-2019-6109 page https://www.suse.com/security/cve/CVE-2019-6111/ SUSE CVE CVE-2019-6111 page Image SLES15-Azure-BYOS Image SLES15-EC2-CHOST-HVM-BYOS Image SLES15-EC2-HVM-BYOS Image SLES15-GCE-BYOS Image SLES15-OCI-BYOS Image SLES15-SAP-Azure Image SLES15-SAP-Azure-BYOS Image SLES15-SAP-Azure-LI-BYOS-Production Image SLES15-SAP-Azure-VLI-BYOS-Production Image SLES15-SAP-EC2-HVM Image SLES15-SAP-EC2-HVM-BYOS Image SLES15-SAP-GCE Image SLES15-SAP-GCE-BYOS Image SLES15-SAP-OCI-BYOS SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Desktop Applications 15 SUSE Linux Enterprise Module for Server Applications 15 openssh-7.6p1-9.23.1 openssh-askpass-gnome-7.6p1-9.23.1 openssh-cavs-7.6p1-9.23.1 openssh-fips-7.6p1-9.23.1 openssh-helpers-7.6p1-9.23.1 openssh-7.6p1-9.23.1 as a component of Image SLES15-Azure-BYOS openssh-7.6p1-9.23.1 as a component of Image SLES15-EC2-CHOST-HVM-BYOS openssh-7.6p1-9.23.1 as a component of Image SLES15-EC2-HVM-BYOS openssh-7.6p1-9.23.1 as a component of Image SLES15-GCE-BYOS openssh-7.6p1-9.23.1 as a component of Image SLES15-OCI-BYOS openssh-7.6p1-9.23.1 as a component of Image SLES15-SAP-Azure openssh-7.6p1-9.23.1 as a component of Image SLES15-SAP-Azure-BYOS openssh-7.6p1-9.23.1 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production openssh-7.6p1-9.23.1 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production openssh-7.6p1-9.23.1 as a component of Image SLES15-SAP-EC2-HVM openssh-7.6p1-9.23.1 as a component of Image SLES15-SAP-EC2-HVM-BYOS openssh-7.6p1-9.23.1 as a component of Image SLES15-SAP-GCE openssh-7.6p1-9.23.1 as a component of Image SLES15-SAP-GCE-BYOS openssh-7.6p1-9.23.1 as a component of Image SLES15-SAP-OCI-BYOS openssh-7.6p1-9.23.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 openssh-helpers-7.6p1-9.23.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 openssh-askpass-gnome-7.6p1-9.23.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 openssh-fips-7.6p1-9.23.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c. CVE-2019-6109 Image SLES15-Azure-BYOS:openssh-7.6p1-9.23.1 Image SLES15-EC2-CHOST-HVM-BYOS:openssh-7.6p1-9.23.1 Image SLES15-EC2-HVM-BYOS:openssh-7.6p1-9.23.1 Image SLES15-GCE-BYOS:openssh-7.6p1-9.23.1 Image SLES15-OCI-BYOS:openssh-7.6p1-9.23.1 Image SLES15-SAP-Azure-BYOS:openssh-7.6p1-9.23.1 Image SLES15-SAP-Azure-LI-BYOS-Production:openssh-7.6p1-9.23.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:openssh-7.6p1-9.23.1 Image SLES15-SAP-Azure:openssh-7.6p1-9.23.1 Image SLES15-SAP-EC2-HVM-BYOS:openssh-7.6p1-9.23.1 Image SLES15-SAP-EC2-HVM:openssh-7.6p1-9.23.1 Image SLES15-SAP-GCE-BYOS:openssh-7.6p1-9.23.1 Image SLES15-SAP-GCE:openssh-7.6p1-9.23.1 Image SLES15-SAP-OCI-BYOS:openssh-7.6p1-9.23.1 SUSE Linux Enterprise Module for Basesystem 15:openssh-7.6p1-9.23.1 SUSE Linux Enterprise Module for Basesystem 15:openssh-helpers-7.6p1-9.23.1 SUSE Linux Enterprise Module for Desktop Applications 15:openssh-askpass-gnome-7.6p1-9.23.1 SUSE Linux Enterprise Module for Server Applications 15:openssh-fips-7.6p1-9.23.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190496-1/ https://www.suse.com/security/cve/CVE-2019-6109.html CVE-2019-6109 https://bugzilla.suse.com/1121571 SUSE Bug 1121571 https://bugzilla.suse.com/1121816 SUSE Bug 1121816 https://bugzilla.suse.com/1121818 SUSE Bug 1121818 https://bugzilla.suse.com/1121821 SUSE Bug 1121821 https://bugzilla.suse.com/1138392 SUSE Bug 1138392 https://bugzilla.suse.com/1144902 SUSE Bug 1144902 https://bugzilla.suse.com/1144903 SUSE Bug 1144903 https://bugzilla.suse.com/1148884 SUSE Bug 1148884 An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). CVE-2019-6111 Image SLES15-Azure-BYOS:openssh-7.6p1-9.23.1 Image SLES15-EC2-CHOST-HVM-BYOS:openssh-7.6p1-9.23.1 Image SLES15-EC2-HVM-BYOS:openssh-7.6p1-9.23.1 Image SLES15-GCE-BYOS:openssh-7.6p1-9.23.1 Image SLES15-OCI-BYOS:openssh-7.6p1-9.23.1 Image SLES15-SAP-Azure-BYOS:openssh-7.6p1-9.23.1 Image SLES15-SAP-Azure-LI-BYOS-Production:openssh-7.6p1-9.23.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:openssh-7.6p1-9.23.1 Image SLES15-SAP-Azure:openssh-7.6p1-9.23.1 Image SLES15-SAP-EC2-HVM-BYOS:openssh-7.6p1-9.23.1 Image SLES15-SAP-EC2-HVM:openssh-7.6p1-9.23.1 Image SLES15-SAP-GCE-BYOS:openssh-7.6p1-9.23.1 Image SLES15-SAP-GCE:openssh-7.6p1-9.23.1 Image SLES15-SAP-OCI-BYOS:openssh-7.6p1-9.23.1 SUSE Linux Enterprise Module for Basesystem 15:openssh-7.6p1-9.23.1 SUSE Linux Enterprise Module for Basesystem 15:openssh-helpers-7.6p1-9.23.1 SUSE Linux Enterprise Module for Desktop Applications 15:openssh-askpass-gnome-7.6p1-9.23.1 SUSE Linux Enterprise Module for Server Applications 15:openssh-fips-7.6p1-9.23.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190496-1/ https://www.suse.com/security/cve/CVE-2019-6111.html CVE-2019-6111 https://bugzilla.suse.com/1121571 SUSE Bug 1121571 https://bugzilla.suse.com/1121816 SUSE Bug 1121816 https://bugzilla.suse.com/1121818 SUSE Bug 1121818 https://bugzilla.suse.com/1121821 SUSE Bug 1121821 https://bugzilla.suse.com/1123028 SUSE Bug 1123028 https://bugzilla.suse.com/1123220 SUSE Bug 1123220 https://bugzilla.suse.com/1131109 SUSE Bug 1131109 https://bugzilla.suse.com/1138392 SUSE Bug 1138392 https://bugzilla.suse.com/1144902 SUSE Bug 1144902 https://bugzilla.suse.com/1144903 SUSE Bug 1144903 https://bugzilla.suse.com/1148884 SUSE Bug 1148884 https://bugzilla.suse.com/1201840 SUSE Bug 1201840