11 KiB
11 KiB
CVE Vulnerability Tracking
Security Vulnerability Mitigations
This role mitigates numerous OpenSSH vulnerabilities through version detection, configuration hardening, and secure defaults. Below is a comprehensive analysis showing which CVEs are fully mitigated, which are conditionally mitigated based on version, and which remain open.
Reference: Official OpenSSH Security Advisories
Fully Mitigated (All Supported Distributions)
These vulnerabilities are mitigated through secure configuration defaults regardless of OpenSSH version:
| CVE | CVSS | Description | Mitigation |
|---|---|---|---|
| CVE-2025-26465 | 6.8 | Man-in-the-middle attack when VerifyHostKeyDNS enabled (9.9p1 and earlier) | ✅ openssh_verify_host_key_dns: false (default) |
| CVE-2020-14145 | 5.9 | Observable discrepancy in client algorithm negotiation (5.7-8.4) | ✅ Modern algorithm preference ordering eliminates timing oracle |
| CVE-2019-6109 | 3.1 | SCP client output spoofing via missing character encoding | ✅ Advisory only - requires MITM during SCP transfer |
| CVE-2019-6110 | 3.1 | SCP client output spoofing via stderr manipulation | ✅ Advisory only - requires MITM during SCP transfer |
| CVE-2018-20685 | 5.3 | SCP client accepting arbitrary objects from malicious server | ✅ Advisory only - not a protocol vulnerability |
| CVE-2016-0777 | 6.5 | Information disclosure in SSH clients 5.4-7.1 (roaming code) | ✅ Fixed in all supported distributions (7.2p2+) |
| CVE-2016-0778 | 4.6 | Buffer overflow in SSH clients 5.4-7.1 (roaming code) | ✅ Fixed in all supported distributions (7.2p2+) |
Conditionally Mitigated (Version-Dependent)
Important Note: Modern Debian and Ubuntu releases apply security patches via backports even to older OpenSSH versions. This means a distribution may be protected despite running an OpenSSH version that was originally vulnerable. Always check security tracker status and keep systems updated.
These vulnerabilities are mitigated through vendor security patches. The role automatically enables additional protections when supported:
| CVE | CVSS | Upstream Affects | Upstream Fixed | Distribution Status |
|---|---|---|---|---|
| CVE-2024-6387 ("regreSSHion" RCE) |
8.1 | 8.5p1-9.7p1 | 9.8p1 | ✅ Debian Bookworm: FIXED via patch 1:9.2p1-2+deb12u3 ✅ Debian Bullseye: NOT AFFECTED (8.4p1 predates vulnerable code) ✅ Debian Trixie/Forky: FIXED (10.0p1-7/8) ✅ Ubuntu 24.04 Noble: FIXED via patch 1:9.6p1-3ubuntu13.3 ✅ Ubuntu 22.04 Jammy: FIXED via patch 1:8.9p1-3ubuntu0.10 ✅ Ubuntu 20.04 Focal: NOT AFFECTED (8.2p1 predates vulnerable code) ✅ Ubuntu 16.04/18.04: NOT AFFECTED |
| CVE-2025-26466 (DoS via SSH2_MSG_PING) |
6.8 | 9.5p1-9.9p1 | 9.9p2 | ⚠️ All Distributions: Awaiting 9.9p2 release 🛡️ Partial Mitigation: PerSourcePenalties (9.8+) provides DoS protection |
| CVE-2024-7589 (FreeBSD blacklistd RCE) |
7.4 | FreeBSD only | N/A | ✅ Not Applicable: Debian/Ubuntu systems not affected |
| CVE-2023-48795 ("Terrapin Attack" - protocol truncation) |
5.9 | All versions <9.6 | 9.6p1 | ✅ ALL DISTRIBUTIONS PATCHED: - Debian Bookworm: 1:9.2p1-2+deb12u5 - Debian Bullseye: 1:8.4p1-5+deb11u3 - Debian Buster: Patched - Ubuntu 24.04: 1:9.6p1-3ubuntu1 - Ubuntu 22.04: 1:8.9p1-3ubuntu0.5 - Ubuntu 20.04: 1:8.2p1-4ubuntu0.10 - Even ESM releases (16.04, 18.04) are patched |
| CVE-2023-38408 (PKCS#11 RCE via ssh-agent) |
9.8 | ≤9.3p1 | 9.3p2 | ✅ ALL DISTRIBUTIONS PATCHED: - Debian Bookworm: 1:9.2p1-2+deb12u7 - Debian Bullseye: 1:8.4p1-5+deb11u3 - Debian Buster: 1:7.9p1-10+deb10u3 - Ubuntu 24.04: 1:9.3p1-1ubuntu2 - Ubuntu 22.04: 1:8.9p1-3ubuntu0.3 - Ubuntu 20.04: 1:8.2p1-4ubuntu0.8 - Even ESM releases patched 🛡️ Additional Protection: Agent forwarding disabled by default in this role |
| CVE-2021-41617 (Privilege escalation) |
7.4 | 6.2-8.7 | 8.8 | ✅ Ubuntu 22.04+: NOT AFFECTED (8.9p1 > 8.8) ✅ Ubuntu 20.04: FIXED via patch 1:8.2p1-4ubuntu0.11 ⚠️ Ubuntu 18.04: VULNERABLE (no patch available) ✅ All Debian: PATCHED via backports 🛡️ Mitigation: Only exploitable with non-default AuthorizedKeysCommand (not enabled by this role) |
| CVE-2021-36368 (Double-free in ssh-agent) |
7.8 | 8.2-8.4 | 8.5 | ✅ Debian Bullseye: PATCHED despite version 8.4p1 ✅ Ubuntu 22.04+: NOT AFFECTED (8.9p1+) ⚠️ Ubuntu 20.04: Potentially vulnerable (8.2p1) - verify patch status |
| CVE-2020-15778 (Command injection in scp) |
7.8 | ≤8.3p1 | 8.4 | ✅ Most distributions: PATCHED ⚠️ Debian Buster: May be vulnerable (7.9p1, EOL) 📋 Workaround: Use sftp instead of scp |
| CVE-2019-16905 (Integer overflow with XMSS) |
7.1 | 7.7-8.0 | 8.1 | ✅ All supported distributions: NOT AFFECTED or FIXED 🛡️ Note: Requires experimental XMSS compile-time support (not standard) |
| CVE-2019-6111 (SCP file overwrite via MITM) |
5.3 | <8.0 | 8.0 | ✅ Modern distributions (8.2p1+): FIXED ⚠️ Debian Stretch/Buster, Ubuntu 16.04-18.04: May be vulnerable (EOL) |
Version-Specific Capability Mitigations
The role applies these enhanced security controls automatically when the OpenSSH version supports them:
| Feature | Requires | Mitigation | CVEs Addressed |
|---|---|---|---|
| PerSourcePenalties | 9.8+ | Automatic rate limiting and attack mitigation | CVE-2025-26466 (partial), general DoS attacks |
| RequiredRSASize 3072 | 9.3+ | Enforces NSA/CISA minimum RSA key size | Weak key attacks, potential future RSA vulnerabilities |
| ML-KEM Post-Quantum KEX | 9.9+ | Quantum-resistant key exchange | Future quantum computer attacks on ECDH |
| DisableForwarding | 7.4+ | Comprehensive forwarding disable (fixed in 10.0) | Forwarding-based privilege escalation |
| LogVerbose | 8.5+ | Enhanced forensic logging for specific subsystems | Improves incident response and attack detection |
| CASignatureAlgorithms | 7.9+ | Restricts CA signature algorithms | Prevents weak signature algorithm attacks |
Open/Unmitigated Vulnerabilities
Good News: With updated systems, most CVEs are patched via vendor security updates. The vulnerabilities below affect only specific EOL or unpatched systems:
| CVE | CVSS | Unpatched Systems | Status | Action Required |
|---|---|---|---|---|
| CVE-2025-26466 | 6.8 | All systems with OpenSSH 9.5p1-9.9p1 | ⚠️ Awaiting Fix | Monitor for OpenSSH 9.9p2 release Partial mitigation: PerSourcePenalties (9.8+) |
| CVE-2021-41617 | 7.4 | Ubuntu 18.04 Bionic (without ESM updates) | ⚠️ Vulnerable | Upgrade to Ubuntu 20.04+ or enable ESM |
| CVE-2021-36368 | 7.8 | Ubuntu 20.04 Focal (if unpatched) | ⚠️ Verify Status | Run apt update && apt upgrade openssh-server |
| Multiple CVEs | Various | Debian Stretch, Buster (EOL) Ubuntu 16.04, 18.04 (without ESM) |
🔴 End-of-Life | Upgrade to supported release |
Distribution-Specific Vulnerability Status
✅ PATCHED: Secure Against All Known Critical CVEs (with updates applied)
These distributions have security patches for all major CVEs. Run apt update && apt upgrade openssh-server to ensure patches are applied:
| Distribution | OpenSSH Version | Security Status | Notes |
|---|---|---|---|
| Debian Trixie/Forky | 10.0p1 | ✅ Fully patched | Latest upstream release |
| Debian Bookworm | 9.2p1 | ✅ PATCHED for CVE-2024-6387 via 1:9.2p1-2+deb12u3 | Despite lower version, all CVEs are patched |
| Debian Bookworm-backports | 10.0p1 | ✅ Fully patched | Latest upstream release |
| Debian Bullseye | 8.4p1 | ✅ NOT AFFECTED by CVE-2024-6387 ✅ Other CVEs patched |
Below vulnerable version range (8.5p1+) |
| Ubuntu 24.10 Oracular | 9.7p1+ | ✅ Fully patched | Includes all security patches |
| Ubuntu 25.04 Plucky | 9.9p1+ | ✅ Fully patched | Post-quantum ready |
| Ubuntu 24.04 Noble LTS | 9.6p1 | ✅ Fully patched | All CVEs addressed via security updates |
| Ubuntu 22.04 Jammy LTS | 8.9p1 | ✅ PATCHED for CVE-2024-6387 via 1:8.9p1-3ubuntu0.10 | All major CVEs backport-patched |
| Ubuntu 20.04 Focal LTS | 8.2p1 | ✅ NOT AFFECTED by CVE-2024-6387 ✅ Most CVEs patched |
Below vulnerable version range (8.5p1+) |
⚠️ VERIFY UPDATES: Potentially Vulnerable if Not Updated
| Distribution | OpenSSH Version | Action Required |
|---|---|---|
| Debian Buster (LTS) | 7.9p1 | ⚠️ End-of-Life - Verify LTS Extended Security Updates are applied 📋 Recommendation: Upgrade to Debian 11+ |
| Ubuntu 20.04 Focal | 8.2p1 | ⚠️ Verify CVE-2021-36368 patch applied: apt policy openssh-serverShould show version ≥ 1:8.2p1-4ubuntu0.11 |
| Ubuntu 18.04 Bionic (ESM) | 7.6p1 | ⚠️ Requires Ubuntu Pro for security updates ⚠️ CVE-2021-41617 marked vulnerable without ESM 📋 Recommendation: Upgrade to Ubuntu 20.04+ LTS |
🔴 END-OF-LIFE: Multiple Critical Vulnerabilities
| Distribution | OpenSSH Version | Status | Action Required |
|---|---|---|---|
| Debian Stretch | 7.4p1 | 🔴 EOL since 2022 | URGENT: Upgrade to Debian 11+ Multiple unpatched critical vulnerabilities |
| Debian Buster | 7.9p1 | 🔴 EOL since 2024 (LTS ends 2026) | Upgrade to Debian 11+ or ensure LTS support |
| Ubuntu 16.04 Xenial | 7.2p2 | 🔴 Standard support ended 2021 | Requires Ubuntu Pro (ESM) or upgrade to 20.04+ LTS Even with ESM, consider upgrading |
Key Takeaways:
- ✅ Most Current LTS Distributions Are Secure: Debian Bullseye+, Ubuntu 20.04+ all have CVE-2024-6387 and other major CVEs patched
- 📦 Backports Work: Vendors apply security patches to older OpenSSH versions - don't just look at version numbers
- 🔄 Keep Systems Updated: Run
apt update && apt upgraderegularly to receive security patches - ⚠️ Check EOL Status: End-of-life distributions (Stretch, Buster, Xenial without ESM) lack security support
- 📋 ESM Consideration: Ubuntu 16.04/18.04 require Ubuntu Pro for Extended Security Maintenance
Verification Command:
# Check your OpenSSH version and package version
ssh -V
apt policy openssh-server
# Verify you're on latest security updates
sudo apt update
sudo apt list --upgradable | grep openssh
Recommendation: For production systems, use Debian Bullseye+ or Ubuntu 20.04+ LTS and maintain regular update schedules. Debian Bookworm and Ubuntu 22.04/24.04 LTS are ideal choices with full vendor support through 2028-2032.