USN-2869-1: OpenSSH vulnerabilities

Publication date

14 January 2016

Overview

OpenSSH could be made to expose sensitive information over the network.


Packages

  • openssh - secure shell (SSH) for secure access to remote machines

Details

It was discovered that the OpenSSH client experimental support for resuming
connections contained multiple security issues. A malicious server could
use this issue to leak client memory to the server, including private
client user keys.

It was discovered that the OpenSSH client experimental support for resuming
connections contained multiple security issues. A malicious server could
use this issue to leak client memory to the server, including private
client user keys.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
15.10 wily openssh-client –  1:6.9p1-2ubuntu0.1
15.04 vivid openssh-client –  1:6.7p1-5ubuntu1.4
14.04 trusty openssh-client –  1:6.6p1-2ubuntu2.4
12.04 precise openssh-client –  1:5.9p1-5ubuntu1.8

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.


Have additional questions?

Talk to a member of the team ›