Severity
Unknown
Vendor
Canonical Ubuntu
Versions Affected
- Canonical Ubuntu 18.04
Description
USN-3809-1 fixed vulnerabilities in OpenSSH. The update for CVE-2018-15473 was incomplete and could introduce a regression in certain environments. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Robert Swiecki discovered that OpenSSH incorrectly handled certain messages. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-10708)
It was discovered that OpenSSH incorrectly handled certain requests. An attacker could possibly use this issue to access sensitive information. (CVE-2018-15473)
Affected Cloud Foundry Products and Versions
Severity is unknown unless otherwise noted.
- Bionic Stemcells
- 1.x versions prior to 1.24
- All other stemcells not listed.
- cflinuxfs3
- All versions prior to 0.252.0
- CF Deployment
- All versions prior to 16.23.0
Mitigation
Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:
- Bionic Stemcells
- Upgrade 1.x versions to 1.24 or greater
- All other stemcells should be upgraded to the latest version available on bosh.io.
- cflinuxfs3
- Upgrade all versions to 0.252.0 or greater
- CF Deployment
- Upgrade all versions to 16.23.0 or greater
References
History
2021-09-07: Initial vulnerability report published.
