User: Password:
|
|
Subscribe / Log in / New account

Mageia alert MGASA-2014-0166 (openssh)

From:  Mageia Updates <buildsystem-daemon@mageia.org>
To:  updates-announce@ml.mageia.org
Subject:  [updates-announce] MGASA-2014-0166: Updated openssh packages fix CVE-2014-2653
Date:  Tue, 8 Apr 2014 14:49:34 +0200
Message-ID:  <20140408124935.070555CB68@valstar.mageia.org>

MGASA-2014-0166 - Updated openssh packages fix CVE-2014-2653 Publication date: 08 Apr 2014 URL: http://advisories.mageia.org/MGASA-2014-0166.html Type: security Affected Mageia releases: 3, 4 CVE: CVE-2014-2653 Description: Updated openssh packages fix security vulnerability: Matthew Vernon reported that if a SSH server offers a HostCertificate that the ssh client doesn't accept, then the client doesn't check the DNS for SSHFP records. As a consequence a malicious server can disable SSHFP-checking by presenting a certificate (CVE-2014-2653). References: - https://www.debian.org/security/2014/dsa-2894 - https://bugs.mageia.org/show_bug.cgi?id=13164 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2653 SRPMS: - 4/core/openssh-6.2p2-3.2.mga4 - 3/core/openssh-6.1p1-4.3.mga3


(Log in to post comments)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds