120 lines
11 KiB
Markdown
120 lines
11 KiB
Markdown
# CVE Vulnerability Tracking
|
|
|
|
### Security Vulnerability Mitigations
|
|
|
|
This role mitigates numerous OpenSSH vulnerabilities through version detection, configuration hardening, and secure defaults. Below is a comprehensive analysis showing which CVEs are fully mitigated, which are conditionally mitigated based on version, and which remain open.
|
|
|
|
**Reference**: [Official OpenSSH Security Advisories](https://www.openssh.com/security.html)
|
|
|
|
#### Fully Mitigated (All Supported Distributions)
|
|
|
|
These vulnerabilities are mitigated through secure configuration defaults regardless of OpenSSH version:
|
|
|
|
| CVE | CVSS | Description | Mitigation |
|
|
|-----|------|-------------|------------|
|
|
| **CVE-2025-26465** | 6.8 | Man-in-the-middle attack when VerifyHostKeyDNS enabled (9.9p1 and earlier) | ✅ `openssh_verify_host_key_dns: false` (default) |
|
|
| **CVE-2020-14145** | 5.9 | Observable discrepancy in client algorithm negotiation (5.7-8.4) | ✅ Modern algorithm preference ordering eliminates timing oracle |
|
|
| **CVE-2019-6109** | 3.1 | SCP client output spoofing via missing character encoding | ✅ Advisory only - requires MITM during SCP transfer |
|
|
| **CVE-2019-6110** | 3.1 | SCP client output spoofing via stderr manipulation | ✅ Advisory only - requires MITM during SCP transfer |
|
|
| **CVE-2018-20685** | 5.3 | SCP client accepting arbitrary objects from malicious server | ✅ Advisory only - not a protocol vulnerability |
|
|
| **CVE-2016-0777** | 6.5 | Information disclosure in SSH clients 5.4-7.1 (roaming code) | ✅ Fixed in all supported distributions (7.2p2+) |
|
|
| **CVE-2016-0778** | 4.6 | Buffer overflow in SSH clients 5.4-7.1 (roaming code) | ✅ Fixed in all supported distributions (7.2p2+) |
|
|
|
|
#### Conditionally Mitigated (Version-Dependent)
|
|
|
|
**Important Note**: Modern Debian and Ubuntu releases apply security patches via backports even to older OpenSSH versions. This means a distribution may be protected despite running an OpenSSH version that was originally vulnerable. Always check security tracker status and keep systems updated.
|
|
|
|
These vulnerabilities are mitigated through vendor security patches. The role automatically enables additional protections when supported:
|
|
|
|
| CVE | CVSS | Upstream Affects | Upstream Fixed | Distribution Status |
|
|
|-----|------|------------------|----------------|---------------------|
|
|
| **CVE-2024-6387**<br>("regreSSHion" RCE) | 8.1 | 8.5p1-9.7p1 | 9.8p1 | ✅ **Debian Bookworm**: FIXED via patch 1:9.2p1-2+deb12u3<br>✅ **Debian Bullseye**: NOT AFFECTED (8.4p1 predates vulnerable code)<br>✅ **Debian Trixie/Forky**: FIXED (10.0p1-7/8)<br>✅ **Ubuntu 24.04 Noble**: FIXED via patch 1:9.6p1-3ubuntu13.3<br>✅ **Ubuntu 22.04 Jammy**: FIXED via patch 1:8.9p1-3ubuntu0.10<br>✅ **Ubuntu 20.04 Focal**: NOT AFFECTED (8.2p1 predates vulnerable code)<br>✅ **Ubuntu 16.04/18.04**: NOT AFFECTED |
|
|
| **CVE-2025-26466**<br>(DoS via SSH2_MSG_PING) | 6.8 | 9.5p1-9.9p1 | 9.9p2 | ⚠️ **All Distributions**: Awaiting 9.9p2 release<br>🛡️ **Partial Mitigation**: PerSourcePenalties (9.8+) provides DoS protection |
|
|
| **CVE-2024-7589**<br>(FreeBSD blacklistd RCE) | 7.4 | FreeBSD only | N/A | ✅ **Not Applicable**: Debian/Ubuntu systems not affected |
|
|
| **CVE-2023-48795**<br>("Terrapin Attack" - protocol truncation) | 5.9 | All versions <9.6 | 9.6p1 | ✅ **ALL DISTRIBUTIONS PATCHED**:<br>- Debian Bookworm: 1:9.2p1-2+deb12u5<br>- Debian Bullseye: 1:8.4p1-5+deb11u3<br>- Debian Buster: Patched<br>- Ubuntu 24.04: 1:9.6p1-3ubuntu1<br>- Ubuntu 22.04: 1:8.9p1-3ubuntu0.5<br>- Ubuntu 20.04: 1:8.2p1-4ubuntu0.10<br>- Even ESM releases (16.04, 18.04) are patched |
|
|
| **CVE-2023-38408**<br>(PKCS#11 RCE via ssh-agent) | 9.8 | ≤9.3p1 | 9.3p2 | ✅ **ALL DISTRIBUTIONS PATCHED**:<br>- Debian Bookworm: 1:9.2p1-2+deb12u7<br>- Debian Bullseye: 1:8.4p1-5+deb11u3<br>- Debian Buster: 1:7.9p1-10+deb10u3<br>- Ubuntu 24.04: 1:9.3p1-1ubuntu2<br>- Ubuntu 22.04: 1:8.9p1-3ubuntu0.3<br>- Ubuntu 20.04: 1:8.2p1-4ubuntu0.8<br>- Even ESM releases patched<br>🛡️ **Additional Protection**: Agent forwarding disabled by default in this role |
|
|
| **CVE-2021-41617**<br>(Privilege escalation) | 7.4 | 6.2-8.7 | 8.8 | ✅ **Ubuntu 22.04+**: NOT AFFECTED (8.9p1 > 8.8)<br>✅ **Ubuntu 20.04**: FIXED via patch 1:8.2p1-4ubuntu0.11<br>⚠️ **Ubuntu 18.04**: VULNERABLE (no patch available)<br>✅ **All Debian**: PATCHED via backports<br>🛡️ **Mitigation**: Only exploitable with non-default AuthorizedKeysCommand (not enabled by this role) |
|
|
| **CVE-2021-36368**<br>(Double-free in ssh-agent) | 7.8 | 8.2-8.4 | 8.5 | ✅ **Debian Bullseye**: PATCHED despite version 8.4p1<br>✅ **Ubuntu 22.04+**: NOT AFFECTED (8.9p1+)<br>⚠️ **Ubuntu 20.04**: Potentially vulnerable (8.2p1) - verify patch status |
|
|
| **CVE-2020-15778**<br>(Command injection in scp) | 7.8 | ≤8.3p1 | 8.4 | ✅ **Most distributions**: PATCHED<br>⚠️ **Debian Buster**: May be vulnerable (7.9p1, EOL)<br>📋 **Workaround**: Use sftp instead of scp |
|
|
| **CVE-2019-16905**<br>(Integer overflow with XMSS) | 7.1 | 7.7-8.0 | 8.1 | ✅ **All supported distributions**: NOT AFFECTED or FIXED<br>🛡️ **Note**: Requires experimental XMSS compile-time support (not standard) |
|
|
| **CVE-2019-6111**<br>(SCP file overwrite via MITM) | 5.3 | <8.0 | 8.0 | ✅ **Modern distributions** (8.2p1+): FIXED<br>⚠️ **Debian Stretch/Buster, Ubuntu 16.04-18.04**: May be vulnerable (EOL) |
|
|
|
|
#### Version-Specific Capability Mitigations
|
|
|
|
The role applies these enhanced security controls automatically when the OpenSSH version supports them:
|
|
|
|
| Feature | Requires | Mitigation | CVEs Addressed |
|
|
|---------|----------|------------|----------------|
|
|
| **PerSourcePenalties** | 9.8+ | Automatic rate limiting and attack mitigation | CVE-2025-26466 (partial), general DoS attacks |
|
|
| **RequiredRSASize 3072** | 9.3+ | Enforces NSA/CISA minimum RSA key size | Weak key attacks, potential future RSA vulnerabilities |
|
|
| **ML-KEM Post-Quantum KEX** | 9.9+ | Quantum-resistant key exchange | Future quantum computer attacks on ECDH |
|
|
| **DisableForwarding** | 7.4+ | Comprehensive forwarding disable (fixed in 10.0) | Forwarding-based privilege escalation |
|
|
| **LogVerbose** | 8.5+ | Enhanced forensic logging for specific subsystems | Improves incident response and attack detection |
|
|
| **CASignatureAlgorithms** | 7.9+ | Restricts CA signature algorithms | Prevents weak signature algorithm attacks |
|
|
|
|
#### Open/Unmitigated Vulnerabilities
|
|
|
|
**Good News**: With updated systems, most CVEs are patched via vendor security updates. The vulnerabilities below affect only specific EOL or unpatched systems:
|
|
|
|
| CVE | CVSS | Unpatched Systems | Status | Action Required |
|
|
|-----|------|-------------------|--------|-----------------|
|
|
| **CVE-2025-26466** | 6.8 | All systems with OpenSSH 9.5p1-9.9p1 | ⚠️ **Awaiting Fix** | Monitor for OpenSSH 9.9p2 release<br>Partial mitigation: PerSourcePenalties (9.8+) |
|
|
| **CVE-2021-41617** | 7.4 | Ubuntu 18.04 Bionic (without ESM updates) | ⚠️ **Vulnerable** | **Upgrade to Ubuntu 20.04+** or enable ESM |
|
|
| **CVE-2021-36368** | 7.8 | Ubuntu 20.04 Focal (if unpatched) | ⚠️ **Verify Status** | **Run `apt update && apt upgrade openssh-server`** |
|
|
| **Multiple CVEs** | Various | Debian Stretch, Buster (EOL)<br>Ubuntu 16.04, 18.04 (without ESM) | 🔴 **End-of-Life** | **Upgrade to supported release** |
|
|
|
|
#### Distribution-Specific Vulnerability Status
|
|
|
|
**✅ PATCHED: Secure Against All Known Critical CVEs (with updates applied)**
|
|
|
|
These distributions have security patches for all major CVEs. **Run `apt update && apt upgrade openssh-server` to ensure patches are applied:**
|
|
|
|
| Distribution | OpenSSH Version | Security Status | Notes |
|
|
|--------------|-----------------|-----------------|-------|
|
|
| **Debian Trixie/Forky** | 10.0p1 | ✅ Fully patched | Latest upstream release |
|
|
| **Debian Bookworm** | 9.2p1 | ✅ **PATCHED** for CVE-2024-6387 via 1:9.2p1-2+deb12u3 | Despite lower version, all CVEs are patched |
|
|
| **Debian Bookworm-backports** | 10.0p1 | ✅ Fully patched | Latest upstream release |
|
|
| **Debian Bullseye** | 8.4p1 | ✅ **NOT AFFECTED** by CVE-2024-6387<br>✅ Other CVEs patched | Below vulnerable version range (8.5p1+) |
|
|
| **Ubuntu 24.10 Oracular** | 9.7p1+ | ✅ Fully patched | Includes all security patches |
|
|
| **Ubuntu 25.04 Plucky** | 9.9p1+ | ✅ Fully patched | Post-quantum ready |
|
|
| **Ubuntu 24.04 Noble LTS** | 9.6p1 | ✅ Fully patched | All CVEs addressed via security updates |
|
|
| **Ubuntu 22.04 Jammy LTS** | 8.9p1 | ✅ **PATCHED** for CVE-2024-6387 via 1:8.9p1-3ubuntu0.10 | All major CVEs backport-patched |
|
|
| **Ubuntu 20.04 Focal LTS** | 8.2p1 | ✅ **NOT AFFECTED** by CVE-2024-6387<br>✅ Most CVEs patched | Below vulnerable version range (8.5p1+) |
|
|
|
|
**⚠️ VERIFY UPDATES: Potentially Vulnerable if Not Updated**
|
|
|
|
| Distribution | OpenSSH Version | Action Required |
|
|
|--------------|-----------------|-----------------|
|
|
| **Debian Buster (LTS)** | 7.9p1 | ⚠️ **End-of-Life** - Verify LTS Extended Security Updates are applied<br>📋 **Recommendation**: Upgrade to Debian 11+ |
|
|
| **Ubuntu 20.04 Focal** | 8.2p1 | ⚠️ Verify CVE-2021-36368 patch applied: `apt policy openssh-server`<br>Should show version ≥ 1:8.2p1-4ubuntu0.11 |
|
|
| **Ubuntu 18.04 Bionic (ESM)** | 7.6p1 | ⚠️ **Requires Ubuntu Pro** for security updates<br>⚠️ CVE-2021-41617 marked vulnerable without ESM<br>📋 **Recommendation**: Upgrade to Ubuntu 20.04+ LTS |
|
|
|
|
**🔴 END-OF-LIFE: Multiple Critical Vulnerabilities**
|
|
|
|
| Distribution | OpenSSH Version | Status | Action Required |
|
|
|--------------|-----------------|--------|-----------------|
|
|
| **Debian Stretch** | 7.4p1 | 🔴 **EOL since 2022** | **URGENT: Upgrade to Debian 11+**<br>Multiple unpatched critical vulnerabilities |
|
|
| **Debian Buster** | 7.9p1 | 🔴 **EOL since 2024** (LTS ends 2026) | **Upgrade to Debian 11+** or ensure LTS support |
|
|
| **Ubuntu 16.04 Xenial** | 7.2p2 | 🔴 **Standard support ended 2021** | **Requires Ubuntu Pro (ESM) or upgrade to 20.04+ LTS**<br>Even with ESM, consider upgrading |
|
|
|
|
**Key Takeaways:**
|
|
|
|
1. **✅ Most Current LTS Distributions Are Secure**: Debian Bullseye+, Ubuntu 20.04+ all have CVE-2024-6387 and other major CVEs patched
|
|
2. **📦 Backports Work**: Vendors apply security patches to older OpenSSH versions - don't just look at version numbers
|
|
3. **🔄 Keep Systems Updated**: Run `apt update && apt upgrade` regularly to receive security patches
|
|
4. **⚠️ Check EOL Status**: End-of-life distributions (Stretch, Buster, Xenial without ESM) lack security support
|
|
5. **📋 ESM Consideration**: Ubuntu 16.04/18.04 require Ubuntu Pro for Extended Security Maintenance
|
|
|
|
**Verification Command:**
|
|
```bash
|
|
# Check your OpenSSH version and package version
|
|
ssh -V
|
|
apt policy openssh-server
|
|
|
|
# Verify you're on latest security updates
|
|
sudo apt update
|
|
sudo apt list --upgradable | grep openssh
|
|
```
|
|
|
|
**Recommendation**: For production systems, use **Debian Bullseye+** or **Ubuntu 20.04+ LTS** and maintain regular update schedules. Debian Bookworm and Ubuntu 22.04/24.04 LTS are ideal choices with full vendor support through 2028-2032.
|