Synopsis

Moderate: openssh security, bug fix, and enhancement update

Type/Severity

Security Advisory: Moderate

Topic

An update for openssh is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

The following packages have been upgraded to a later upstream version: openssh (8.0p1). (BZ#1691045)

Security Fix(es):

• openssh: scp client improper directory name validation (CVE-2018-20685)
  
• openssh: Improper validation of object names allows malicious server to overwrite files via scp client (CVE-2019-6111)
  
• openssh: Missing character encoding in progress display allows for spoofing of scp client output (CVE-2019-6109)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

• BZ - 1665785 - CVE-2018-20685 openssh: scp client improper directory name validation
• BZ - 1666119 - CVE-2019-6109 openssh: Missing character encoding in progress display allows for spoofing of scp client output
• BZ - 1666127 - CVE-2019-6111 openssh: Improper validation of object names allows malicious server to overwrite files via scp client
• BZ - 1667519 - ssh-copy-id hangs when the remote system is out of space
• BZ - 1668325 - openssh - man pages do not mention crypto-policies
• BZ - 1683295 - Kerberos cleanup procedures do not work with GSSAPIDelegateCredentials and default ccache from krb5.conf
• BZ - 1685096 - In FIPS mode, during DH group exchange, OpenSSH client should validate the received moduli, making sure it is one of the known groups.
• BZ - 1686065 - SSH connections get closed when time-based rekeyring is used and ClientAliveMaxCount=0
• BZ - 1691045 - Rebase OpenSSH to latest release (8.0p1?)
• BZ - 1707485 - Use high-level API to do signatures
• BZ - 1712436 - MD5 is used when writing password protected PEM
• BZ - 1732424 - ssh-keygen -A fails in FIPS mode because of DSA key
• BZ - 1732449 - rsa-sha2-*-cert-v01@openssh.com host key types are ignored in FIPS despite being in the policy

CVEs

• CVE-2018-20685
• CVE-2019-6109
• CVE-2019-6111

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/

Red Hat Enterprise Linux for x86_64 8

SRPM
openssh-8.0p1-3.el8.src.rpm	SHA-256: 97187c47e111936d8c329052ba9ca7dfc82896ae285cb38f583a7bb82a49bf75
x86_64
openssh-8.0p1-3.el8.x86_64.rpm	SHA-256: d297292ce99960f0881addff4eaf915c4b08373fbb7d3689c4028f36d96c3e38
openssh-askpass-8.0p1-3.el8.x86_64.rpm	SHA-256: d2db74f60dbd8fa33cb0a5d096a282471d8a4cb7c7d616196289911190f11c23
openssh-askpass-debuginfo-8.0p1-3.el8.x86_64.rpm	SHA-256: 42b2edafdeda18538f43fab68ec9ca2948f6a85cbcdf9b8e2109f04bed77806e
openssh-askpass-debuginfo-8.0p1-3.el8.x86_64.rpm	SHA-256: 42b2edafdeda18538f43fab68ec9ca2948f6a85cbcdf9b8e2109f04bed77806e
openssh-cavs-8.0p1-3.el8.x86_64.rpm	SHA-256: c24b667846d48df252cfcd30eddfe6a3853d8bb54d35385ea224939b7670e48b
openssh-cavs-debuginfo-8.0p1-3.el8.x86_64.rpm	SHA-256: c4290adf0c89356865bfdc3779de2b17782267e24599beaa047c74c85f0e640f
openssh-cavs-debuginfo-8.0p1-3.el8.x86_64.rpm	SHA-256: c4290adf0c89356865bfdc3779de2b17782267e24599beaa047c74c85f0e640f
openssh-clients-8.0p1-3.el8.x86_64.rpm	SHA-256: fc379810de12d9e4e3f215926cf3513bc5f5127459538824cfc8943958754e2c
openssh-clients-debuginfo-8.0p1-3.el8.x86_64.rpm	SHA-256: 3e3ca455c6b746e79934f5fcdc8f051351f645cdecb3f8454ae84e83c616cc85
openssh-clients-debuginfo-8.0p1-3.el8.x86_64.rpm	SHA-256: 3e3ca455c6b746e79934f5fcdc8f051351f645cdecb3f8454ae84e83c616cc85
openssh-debuginfo-8.0p1-3.el8.x86_64.rpm	SHA-256: 21aa0707e9ab59e9481d85bdf663c02e815168b29ba638e522737b7000c9f9b1
openssh-debuginfo-8.0p1-3.el8.x86_64.rpm	SHA-256: 21aa0707e9ab59e9481d85bdf663c02e815168b29ba638e522737b7000c9f9b1
openssh-debugsource-8.0p1-3.el8.x86_64.rpm	SHA-256: 5cc6ddd6f1f473b4c619a80f0982227b65553728c95927a123435a8bb0274cae
openssh-debugsource-8.0p1-3.el8.x86_64.rpm	SHA-256: 5cc6ddd6f1f473b4c619a80f0982227b65553728c95927a123435a8bb0274cae
openssh-keycat-8.0p1-3.el8.x86_64.rpm	SHA-256: bf6e1d1cc9073345cf0de0eba4e79e6414821e687f245d81532641f6982d00c7
openssh-keycat-debuginfo-8.0p1-3.el8.x86_64.rpm	SHA-256: 489a50cd9d724b207fefcb72c795df07b3b4d0f25d4280f38d8c74670eec2ccd
openssh-keycat-debuginfo-8.0p1-3.el8.x86_64.rpm	SHA-256: 489a50cd9d724b207fefcb72c795df07b3b4d0f25d4280f38d8c74670eec2ccd
openssh-ldap-8.0p1-3.el8.x86_64.rpm	SHA-256: a32a809d8b63bb9a56039969e4d1eda2a8817720094b99ec095d8c12b63cc38a
openssh-ldap-debuginfo-8.0p1-3.el8.x86_64.rpm	SHA-256: aeace48b568ad2af56bdb8bd95c425c052bbc15c85a1ddbe28848241203df170
openssh-ldap-debuginfo-8.0p1-3.el8.x86_64.rpm	SHA-256: aeace48b568ad2af56bdb8bd95c425c052bbc15c85a1ddbe28848241203df170
openssh-server-8.0p1-3.el8.x86_64.rpm	SHA-256: 50e37ea176ad3e851cef925dc1504dcfa2e806521db1d3f71d1b54b5fd6c0a00
openssh-server-debuginfo-8.0p1-3.el8.x86_64.rpm	SHA-256: 02d420c65d42d685ad0980446b9c744f0401585682203ea26d3e5d34621b3239
openssh-server-debuginfo-8.0p1-3.el8.x86_64.rpm	SHA-256: 02d420c65d42d685ad0980446b9c744f0401585682203ea26d3e5d34621b3239
pam_ssh_agent_auth-0.10.3-7.3.el8.x86_64.rpm	SHA-256: 06d9eb84ae5c0bb559b6248e5372ee47b1f1c6aad6bd7b7a7bc1d1a407c44ef8
pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.x86_64.rpm	SHA-256: 0dff9b457d8cacbd62e8b9c6460bcd461b1230757c805cd8071767ed3af8732a
pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.x86_64.rpm	SHA-256: 0dff9b457d8cacbd62e8b9c6460bcd461b1230757c805cd8071767ed3af8732a

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
openssh-8.0p1-3.el8.src.rpm	SHA-256: 97187c47e111936d8c329052ba9ca7dfc82896ae285cb38f583a7bb82a49bf75
s390x
openssh-8.0p1-3.el8.s390x.rpm	SHA-256: 5e67c04c6473f9a5d3a622ee16b916bcc4e7bb35b3f77de2954a60b709549dd6
openssh-askpass-8.0p1-3.el8.s390x.rpm	SHA-256: 52afcde3e0c9f685e84080d864d1eae7b9f5f443f9e3323c3c89e74ecebfbc5d
openssh-askpass-debuginfo-8.0p1-3.el8.s390x.rpm	SHA-256: 831a99b1b5c9a88bc2f4130d9f29ac0a575b6956a6fcaaa39a250dd39579d430
openssh-askpass-debuginfo-8.0p1-3.el8.s390x.rpm	SHA-256: 831a99b1b5c9a88bc2f4130d9f29ac0a575b6956a6fcaaa39a250dd39579d430
openssh-cavs-8.0p1-3.el8.s390x.rpm	SHA-256: 48483afd0f1cb76594214f54d04dabc85f46ae4050fca7f6a73a931726551071
openssh-cavs-debuginfo-8.0p1-3.el8.s390x.rpm	SHA-256: b1f0434791cfe57591c15f8c305e107c1dcf5285a039055f60202ae0a41582dc
openssh-cavs-debuginfo-8.0p1-3.el8.s390x.rpm	SHA-256: b1f0434791cfe57591c15f8c305e107c1dcf5285a039055f60202ae0a41582dc
openssh-clients-8.0p1-3.el8.s390x.rpm	SHA-256: 7c7b8e242c28934eed0f661b968fb97ad7835e51d991683eb8ce236d1c4d2fb6
openssh-clients-debuginfo-8.0p1-3.el8.s390x.rpm	SHA-256: 1cee215dfd153525d239699e26c59b903bf1f113a83d7b6a11b9981a957b6e67
openssh-clients-debuginfo-8.0p1-3.el8.s390x.rpm	SHA-256: 1cee215dfd153525d239699e26c59b903bf1f113a83d7b6a11b9981a957b6e67
openssh-debuginfo-8.0p1-3.el8.s390x.rpm	SHA-256: 1742ad32381fed1167a1a4c46c064371d91a8dcf06123739f736b70dd09040e3
openssh-debuginfo-8.0p1-3.el8.s390x.rpm	SHA-256: 1742ad32381fed1167a1a4c46c064371d91a8dcf06123739f736b70dd09040e3
openssh-debugsource-8.0p1-3.el8.s390x.rpm	SHA-256: a45de8d22249e04e78598506614a1cc688913c916188e26f6e8e415f662fd7ef
openssh-debugsource-8.0p1-3.el8.s390x.rpm	SHA-256: a45de8d22249e04e78598506614a1cc688913c916188e26f6e8e415f662fd7ef
openssh-keycat-8.0p1-3.el8.s390x.rpm	SHA-256: 5ee843c463a0bfa4163f70e3485270744a9d887d2d8c29e30eb4c49ee61e3ae1
openssh-keycat-debuginfo-8.0p1-3.el8.s390x.rpm	SHA-256: e8471a4ebe9dba442adcdd59ddb511e3930da22a3149bf8139196ffd9a5c70d3
openssh-keycat-debuginfo-8.0p1-3.el8.s390x.rpm	SHA-256: e8471a4ebe9dba442adcdd59ddb511e3930da22a3149bf8139196ffd9a5c70d3
openssh-ldap-8.0p1-3.el8.s390x.rpm	SHA-256: 107420046f0ff81ddd9e5d853b06aa09e10ab74bc5aa9cdd4efbe6234c9a9cd4
openssh-ldap-debuginfo-8.0p1-3.el8.s390x.rpm	SHA-256: 3c2802133484246f40051c452ef8649f7f28114a652279ba5e0e68e52b3a1729
openssh-ldap-debuginfo-8.0p1-3.el8.s390x.rpm	SHA-256: 3c2802133484246f40051c452ef8649f7f28114a652279ba5e0e68e52b3a1729
openssh-server-8.0p1-3.el8.s390x.rpm	SHA-256: 00bd63439a6cb0277cb0e4b465cbd473a8b45e44536cff3fb42b88af26d7544a
openssh-server-debuginfo-8.0p1-3.el8.s390x.rpm	SHA-256: ccf78062c22ec45fc64521c204174cb0d197fcaebe677fb80596129f81a3c1a5
openssh-server-debuginfo-8.0p1-3.el8.s390x.rpm	SHA-256: ccf78062c22ec45fc64521c204174cb0d197fcaebe677fb80596129f81a3c1a5
pam_ssh_agent_auth-0.10.3-7.3.el8.s390x.rpm	SHA-256: 80dbd581fa262108623c0b763603860747ef3acb34224746dbf17a2e3aa0d216
pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.s390x.rpm	SHA-256: 93acdca826a1b3c2e6460a4fad75ac334d60166aa7c9e8673c64d185bb28827c
pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.s390x.rpm	SHA-256: 93acdca826a1b3c2e6460a4fad75ac334d60166aa7c9e8673c64d185bb28827c

Red Hat Enterprise Linux for Power, little endian 8

SRPM
openssh-8.0p1-3.el8.src.rpm	SHA-256: 97187c47e111936d8c329052ba9ca7dfc82896ae285cb38f583a7bb82a49bf75
ppc64le
openssh-8.0p1-3.el8.ppc64le.rpm	SHA-256: 48a7d91619f194d83d1b20780a44aaa7c0823c367432cb64ecfc26b55534cf38
openssh-askpass-8.0p1-3.el8.ppc64le.rpm	SHA-256: 81479ea5aa60f7f7f160f20e660d13ca0e0913189d804d2d2a9de0afb151f33d
openssh-askpass-debuginfo-8.0p1-3.el8.ppc64le.rpm	SHA-256: ec865f4bf11544bb17ea2427dfc7949b4d10ebd1ab06e83d2a51658799808cc6
openssh-askpass-debuginfo-8.0p1-3.el8.ppc64le.rpm	SHA-256: ec865f4bf11544bb17ea2427dfc7949b4d10ebd1ab06e83d2a51658799808cc6
openssh-cavs-8.0p1-3.el8.ppc64le.rpm	SHA-256: 4f0c05030d3b118c439f9db52f274d6087ca34b2f311897c4bdf221a009ebfa6
openssh-cavs-debuginfo-8.0p1-3.el8.ppc64le.rpm	SHA-256: 130dcc7f100c325494e0516a66ff5cce95376949e94d472b5e82dce4d2b8903d
openssh-cavs-debuginfo-8.0p1-3.el8.ppc64le.rpm	SHA-256: 130dcc7f100c325494e0516a66ff5cce95376949e94d472b5e82dce4d2b8903d
openssh-clients-8.0p1-3.el8.ppc64le.rpm	SHA-256: 6e8a755f3848bb494e967ee4b8b3e29c06c482dfdfd3553e797b6196b8d044aa
openssh-clients-debuginfo-8.0p1-3.el8.ppc64le.rpm	SHA-256: a1691b65b55e23dd31dc5d5934e92668228436c6dd756208e0ea3b11d5aee9fc
openssh-clients-debuginfo-8.0p1-3.el8.ppc64le.rpm	SHA-256: a1691b65b55e23dd31dc5d5934e92668228436c6dd756208e0ea3b11d5aee9fc
openssh-debuginfo-8.0p1-3.el8.ppc64le.rpm	SHA-256: 32fc18ad960544d40ed0bfd4c84df83b9c5f1401e32eb922a85d795800970459
openssh-debuginfo-8.0p1-3.el8.ppc64le.rpm	SHA-256: 32fc18ad960544d40ed0bfd4c84df83b9c5f1401e32eb922a85d795800970459
openssh-debugsource-8.0p1-3.el8.ppc64le.rpm	SHA-256: 0c32044fa282b23ecac8f4f352892910082c9ed0755aec1ab3d3c81851ea0159
openssh-debugsource-8.0p1-3.el8.ppc64le.rpm	SHA-256: 0c32044fa282b23ecac8f4f352892910082c9ed0755aec1ab3d3c81851ea0159
openssh-keycat-8.0p1-3.el8.ppc64le.rpm	SHA-256: a70d80d33c77c932726acfeb619c777a427c40aeeb822baaa7c9dc0ab58f5fe2
openssh-keycat-debuginfo-8.0p1-3.el8.ppc64le.rpm	SHA-256: 3cf9ebacbc5e33ab29f2bd792e4e645ff76a4ed98b9694879aefc231ade0a47a
openssh-keycat-debuginfo-8.0p1-3.el8.ppc64le.rpm	SHA-256: 3cf9ebacbc5e33ab29f2bd792e4e645ff76a4ed98b9694879aefc231ade0a47a
openssh-ldap-8.0p1-3.el8.ppc64le.rpm	SHA-256: 2c3b33cc17b75a2cfb4bef78d23af3b9db0ae4c26fb60cd1fedc413aebbf6698
openssh-ldap-debuginfo-8.0p1-3.el8.ppc64le.rpm	SHA-256: b239582655a30493c823cc15720451c686fda8f967072524fc9a800f2c250268
openssh-ldap-debuginfo-8.0p1-3.el8.ppc64le.rpm	SHA-256: b239582655a30493c823cc15720451c686fda8f967072524fc9a800f2c250268
openssh-server-8.0p1-3.el8.ppc64le.rpm	SHA-256: 21d63bf3f0158073da985d462cf58b31808f1665c94f11f036cd3aa8aa15cb64
openssh-server-debuginfo-8.0p1-3.el8.ppc64le.rpm	SHA-256: 5981b6aabbd80c01eb44bce71131fb69b693523b9c15b056e3e2a84b94f549be
openssh-server-debuginfo-8.0p1-3.el8.ppc64le.rpm	SHA-256: 5981b6aabbd80c01eb44bce71131fb69b693523b9c15b056e3e2a84b94f549be
pam_ssh_agent_auth-0.10.3-7.3.el8.ppc64le.rpm	SHA-256: 17193984c8c6eee1b1991c788d6731d0e7ed2ca3b30ddecdd43904fc5f138e42
pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.ppc64le.rpm	SHA-256: 6c43e9f25182085192d17e3f659bb52a4c93409ec255c9297fd070ebf64e895c
pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.ppc64le.rpm	SHA-256: 6c43e9f25182085192d17e3f659bb52a4c93409ec255c9297fd070ebf64e895c

Red Hat Enterprise Linux for ARM 64 8

SRPM
openssh-8.0p1-3.el8.src.rpm	SHA-256: 97187c47e111936d8c329052ba9ca7dfc82896ae285cb38f583a7bb82a49bf75
aarch64
openssh-8.0p1-3.el8.aarch64.rpm	SHA-256: fe9b9fcc3b208f11af9d134f760fd193cf7e5d121ac5f19f2d30c07051ba8086
openssh-askpass-8.0p1-3.el8.aarch64.rpm	SHA-256: b3df924df9cf7854c83e4d73fee7d413d279ded61e6a4684b44cb65245a5cce4
openssh-askpass-debuginfo-8.0p1-3.el8.aarch64.rpm	SHA-256: aae39c2c556e2c3b75f0fb2651b2ed4865d4df4fb56f6977920d8d429b6e3199
openssh-askpass-debuginfo-8.0p1-3.el8.aarch64.rpm	SHA-256: aae39c2c556e2c3b75f0fb2651b2ed4865d4df4fb56f6977920d8d429b6e3199
openssh-cavs-8.0p1-3.el8.aarch64.rpm	SHA-256: 80411795896fc7a130bd16e04ef587e54463fc35a8a4e3a31fe77891430475b4
openssh-cavs-debuginfo-8.0p1-3.el8.aarch64.rpm	SHA-256: cb9791b3799e5b9d53a7f0e8c3d07a6b74a749aa98bd4a208777e1d43746413f
openssh-cavs-debuginfo-8.0p1-3.el8.aarch64.rpm	SHA-256: cb9791b3799e5b9d53a7f0e8c3d07a6b74a749aa98bd4a208777e1d43746413f
openssh-clients-8.0p1-3.el8.aarch64.rpm	SHA-256: 69c327e1f43a3033bcc4537e08718e5f8fdb39a02dd3989cd7116d94fe944622
openssh-clients-debuginfo-8.0p1-3.el8.aarch64.rpm	SHA-256: 0fbfc84e564bfb72e40da6c534166a2d7bd30282e82d708acfae293a4f3af7ed
openssh-clients-debuginfo-8.0p1-3.el8.aarch64.rpm	SHA-256: 0fbfc84e564bfb72e40da6c534166a2d7bd30282e82d708acfae293a4f3af7ed
openssh-debuginfo-8.0p1-3.el8.aarch64.rpm	SHA-256: 2004061c143f250f56e83e61a0fd26ff1dcb1ac35a558e6d49f2e5f1c3b89ed0
openssh-debuginfo-8.0p1-3.el8.aarch64.rpm	SHA-256: 2004061c143f250f56e83e61a0fd26ff1dcb1ac35a558e6d49f2e5f1c3b89ed0
openssh-debugsource-8.0p1-3.el8.aarch64.rpm	SHA-256: c6d8c917bd58f7d2b4e062aa2aeb069a4a993f84230f907079a93c54c321c8ec
openssh-debugsource-8.0p1-3.el8.aarch64.rpm	SHA-256: c6d8c917bd58f7d2b4e062aa2aeb069a4a993f84230f907079a93c54c321c8ec
openssh-keycat-8.0p1-3.el8.aarch64.rpm	SHA-256: 3aee5b22a65f73d7937d23bcd894a40eeb2c684544308e1116fa60df93952efd
openssh-keycat-debuginfo-8.0p1-3.el8.aarch64.rpm	SHA-256: 3450c1f674ab00ce1a021f6ac61ee15fde8bcc653daa04531ea06980cff56eb6
openssh-keycat-debuginfo-8.0p1-3.el8.aarch64.rpm	SHA-256: 3450c1f674ab00ce1a021f6ac61ee15fde8bcc653daa04531ea06980cff56eb6
openssh-ldap-8.0p1-3.el8.aarch64.rpm	SHA-256: 1ba5aa1f779f13e8d6419e7c4533e4ad727d7314ec5e55c7900f5e2af19d3996
openssh-ldap-debuginfo-8.0p1-3.el8.aarch64.rpm	SHA-256: 3fba1508440c23ef353d24fa023bfb43a07e773e8c296c6196264a65b1c68f1b
openssh-ldap-debuginfo-8.0p1-3.el8.aarch64.rpm	SHA-256: 3fba1508440c23ef353d24fa023bfb43a07e773e8c296c6196264a65b1c68f1b
openssh-server-8.0p1-3.el8.aarch64.rpm	SHA-256: a80c0d8db31cccb4bed147de45abf696f04231a4f535518814fce2822f98eadf
openssh-server-debuginfo-8.0p1-3.el8.aarch64.rpm	SHA-256: 7b07133c63da47b53b32d89c64eea41aac2c13119930f941a976b01a6d838898
openssh-server-debuginfo-8.0p1-3.el8.aarch64.rpm	SHA-256: 7b07133c63da47b53b32d89c64eea41aac2c13119930f941a976b01a6d838898
pam_ssh_agent_auth-0.10.3-7.3.el8.aarch64.rpm	SHA-256: 55117bd8e214b04616d51c4b07be2a2798e72b31635d92fd86e991694f34af25
pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.aarch64.rpm	SHA-256: ecf37802fd62f1e67c419ef7a8ae9164264f4430258d09f6d8ec0e5337899665
pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.aarch64.rpm	SHA-256: ecf37802fd62f1e67c419ef7a8ae9164264f4430258d09f6d8ec0e5337899665