Security update for openssh SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:3866-1 Final 1 1 2020-12-17T11:06:21Z current 2020-12-17T11:06:21Z 2020-12-17T11:06:21Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssh This update for openssh fixes the following issues: - CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513). - Supplement libgtk-3-0 instead of libX11-6 to avoid installation on a textmode install (bsc#1142000) - Fixed an issue where oracle cluster with cluvfy using 'scp' failing/missinterpreted (bsc#1148566). - Fixed sshd termination of multichannel sessions with non-root users (bsc#1115550,bsc#1174162). - Added speculative hardening for key storage (bsc#1139398). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP1-Azure-BYOS-2020-3866,Image SLES15-SP1-Azure-HPC-BYOS-2020-3866,Image SLES15-SP1-CHOST-BYOS-Azure-2020-3866,Image SLES15-SP1-CHOST-BYOS-EC2-2020-3866,Image SLES15-SP1-CHOST-BYOS-GCE-2020-3866,Image SLES15-SP1-EC2-HPC-HVM-BYOS-2020-3866,Image SLES15-SP1-EC2-HVM-BYOS-2020-3866,Image SLES15-SP1-GCE-BYOS-2020-3866,Image SLES15-SP1-Manager-4-0-Azure-BYOS-Proxy-2020-3866,Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server-2020-3866,Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Proxy-2020-3866,Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server-2020-3866,Image SLES15-SP1-Manager-4-0-GCE-BYOS-Proxy-2020-3866,Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server-2020-3866,Image SLES15-SP1-OCI-BYOS-2020-3866,Image SLES15-SP1-SAP-Azure-2020-3866,Image SLES15-SP1-SAP-Azure-BYOS-2020-3866,Image SLES15-SP1-SAP-Azure-LI-BYOS-Production-2020-3866,Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production-2020-3866,Image SLES15-SP1-SAP-EC2-HVM-2020-3866,Image SLES15-SP1-SAP-EC2-HVM-BYOS-2020-3866,Image SLES15-SP1-SAP-GCE-2020-3866,Image SLES15-SP1-SAP-GCE-BYOS-2020-3866,Image SLES15-SP1-SAP-OCI-BYOS-2020-3866,Image SLES15-SP1-SAPCAL-Azure-2020-3866,Image SLES15-SP1-SAPCAL-EC2-HVM-2020-3866,Image SLES15-SP1-SAPCAL-GCE-2020-3866,SUSE-2020-3866,SUSE-SLE-Module-Basesystem-15-SP1-2020-3866,SUSE-SLE-Module-Desktop-Applications-15-SP1-2020-3866,SUSE-SLE-Module-Server-Applications-15-SP1-2020-3866 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20203866-1/ Link for SUSE-SU-2020:3866-1 https://lists.suse.com/pipermail/sle-security-updates/2020-December/008083.html E-Mail link for SUSE-SU-2020:3866-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1115550 SUSE Bug 1115550 https://bugzilla.suse.com/1139398 SUSE Bug 1139398 https://bugzilla.suse.com/1142000 SUSE Bug 1142000 https://bugzilla.suse.com/1148566 SUSE Bug 1148566 https://bugzilla.suse.com/1173513 SUSE Bug 1173513 https://bugzilla.suse.com/1174162 SUSE Bug 1174162 https://www.suse.com/security/cve/CVE-2020-14145/ SUSE CVE CVE-2020-14145 page Image SLES15-SP1-Azure-BYOS Image SLES15-SP1-Azure-HPC-BYOS Image SLES15-SP1-CHOST-BYOS-Azure Image SLES15-SP1-CHOST-BYOS-EC2 Image SLES15-SP1-CHOST-BYOS-GCE Image SLES15-SP1-EC2-HPC-HVM-BYOS Image SLES15-SP1-EC2-HVM-BYOS Image SLES15-SP1-GCE-BYOS Image SLES15-SP1-Manager-4-0-Azure-BYOS-Proxy Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Proxy Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server Image SLES15-SP1-Manager-4-0-GCE-BYOS-Proxy Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server Image SLES15-SP1-OCI-BYOS Image SLES15-SP1-SAP-Azure Image SLES15-SP1-SAP-Azure-BYOS Image SLES15-SP1-SAP-Azure-LI-BYOS-Production Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production Image SLES15-SP1-SAP-EC2-HVM Image SLES15-SP1-SAP-EC2-HVM-BYOS Image SLES15-SP1-SAP-GCE Image SLES15-SP1-SAP-GCE-BYOS Image SLES15-SP1-SAP-OCI-BYOS Image SLES15-SP1-SAPCAL-Azure Image SLES15-SP1-SAPCAL-EC2-HVM Image SLES15-SP1-SAPCAL-GCE SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 openssh-7.9p1-6.22.1 openssh-askpass-gnome-7.9p1-6.22.1 openssh-cavs-7.9p1-6.22.1 openssh-fips-7.9p1-6.22.1 openssh-helpers-7.9p1-6.22.1 openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-Azure-BYOS openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-Azure-HPC-BYOS openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-CHOST-BYOS-Azure openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-CHOST-BYOS-EC2 openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-CHOST-BYOS-GCE openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-EC2-HPC-HVM-BYOS openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-EC2-HVM-BYOS openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-GCE-BYOS openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-Manager-4-0-Azure-BYOS-Proxy openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Proxy openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-Manager-4-0-GCE-BYOS-Proxy openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-OCI-BYOS openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-SAP-Azure openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-SAP-Azure-BYOS openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-SAP-EC2-HVM openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-SAP-EC2-HVM-BYOS openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-SAP-GCE openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-SAP-GCE-BYOS openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-SAP-OCI-BYOS openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-SAPCAL-Azure openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-SAPCAL-EC2-HVM openssh-7.9p1-6.22.1 as a component of Image SLES15-SP1-SAPCAL-GCE openssh-7.9p1-6.22.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 openssh-helpers-7.9p1-6.22.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 openssh-askpass-gnome-7.9p1-6.22.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 openssh-fips-7.9p1-6.22.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected. CVE-2020-14145 Image SLES15-SP1-Azure-BYOS:openssh-7.9p1-6.22.1 Image SLES15-SP1-Azure-HPC-BYOS:openssh-7.9p1-6.22.1 Image SLES15-SP1-CHOST-BYOS-Azure:openssh-7.9p1-6.22.1 Image SLES15-SP1-CHOST-BYOS-EC2:openssh-7.9p1-6.22.1 Image SLES15-SP1-CHOST-BYOS-GCE:openssh-7.9p1-6.22.1 Image SLES15-SP1-EC2-HPC-HVM-BYOS:openssh-7.9p1-6.22.1 Image SLES15-SP1-EC2-HVM-BYOS:openssh-7.9p1-6.22.1 Image SLES15-SP1-GCE-BYOS:openssh-7.9p1-6.22.1 Image SLES15-SP1-Manager-4-0-Azure-BYOS-Proxy:openssh-7.9p1-6.22.1 Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:openssh-7.9p1-6.22.1 Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Proxy:openssh-7.9p1-6.22.1 Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:openssh-7.9p1-6.22.1 Image SLES15-SP1-Manager-4-0-GCE-BYOS-Proxy:openssh-7.9p1-6.22.1 Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:openssh-7.9p1-6.22.1 Image SLES15-SP1-OCI-BYOS:openssh-7.9p1-6.22.1 Image SLES15-SP1-SAP-Azure-BYOS:openssh-7.9p1-6.22.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:openssh-7.9p1-6.22.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:openssh-7.9p1-6.22.1 Image SLES15-SP1-SAP-Azure:openssh-7.9p1-6.22.1 Image SLES15-SP1-SAP-EC2-HVM-BYOS:openssh-7.9p1-6.22.1 Image SLES15-SP1-SAP-EC2-HVM:openssh-7.9p1-6.22.1 Image SLES15-SP1-SAP-GCE-BYOS:openssh-7.9p1-6.22.1 Image SLES15-SP1-SAP-GCE:openssh-7.9p1-6.22.1 Image SLES15-SP1-SAP-OCI-BYOS:openssh-7.9p1-6.22.1 Image SLES15-SP1-SAPCAL-Azure:openssh-7.9p1-6.22.1 Image SLES15-SP1-SAPCAL-EC2-HVM:openssh-7.9p1-6.22.1 Image SLES15-SP1-SAPCAL-GCE:openssh-7.9p1-6.22.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:openssh-7.9p1-6.22.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:openssh-helpers-7.9p1-6.22.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:openssh-askpass-gnome-7.9p1-6.22.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:openssh-fips-7.9p1-6.22.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203866-1/ https://www.suse.com/security/cve/CVE-2020-14145.html CVE-2020-14145 https://bugzilla.suse.com/1173513 SUSE Bug 1173513 https://bugzilla.suse.com/1177569 SUSE Bug 1177569 https://bugzilla.suse.com/1189078 SUSE Bug 1189078