Ubuntu alert USN-6887-1 (openssh)

From:
             
 
Marc Deslauriers <marc.deslauriers@canonical.com>
To:
             
 
"ubuntu-security-announce@lists.ubuntu.com" <ubuntu-security-announce@lists.ubuntu.com>
Subject:
             
 
[USN-6887-1] OpenSSH vulnerability
Date:
             
 
Tue, 09 Jul 2024 12:39:30 -0400
Message-ID:
             
 
<0dd00783-4da7-4a6f-bcb7-0e0dc136c31a@canonical.com>
==========================================================================
Ubuntu Security Notice USN-6887-1
July 09, 2024

openssh vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS

Summary:

OpenSSH could be made to expose timing information over the network.

Software Description:
- openssh: secure shell (SSH) for secure access to remote machines

Details:

Philippos Giavridis, Jacky Wei En Kung, Daniel Hugenroth, and Alastair
Beresford discovered that the OpenSSH ObscureKeystrokeTiming feature did
not work as expected. A remote attacker could possibly use this issue to
determine timing information about keystrokes.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
   openssh-client                  1:9.6p1-3ubuntu13.4
   openssh-server                  1:9.6p1-3ubuntu13.4

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6887-1
   CVE-2024-39894

Package Information:
   https://launchpad.net/ubuntu/+source/openssh/1:9.6p1-3ubu...



Attachment: OpenPGP_signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmaNZ8IACgkQZWnYVadE
vpPpzw/+IluKUhdzSDRkWTqSJWBYWMQBn4AjHCd2M7+GXDlSmTjbg2ZPudDw9LPU
VKyK2fCsEIjVoiAljNGv/JBezcuzW0IWn+8WdWWtBwVmg8GnD0Js2tmDTjPrydsU
usGHriG61fiSYeW5oPto9lruzL0f1UMYBGdV9LPQWBV0VEvmXrhAQ3m4+evk2oCd
sS5h3dXSTSd7dD/TAC2F8/HQfUdz5ID6p9lJoHRZXDpsXCrXL0sMlHKoTS9hL/GZ
Zi4K3XvzE6z9eoijVxcHi/rn+ozDd487qApZr3bFDvdrLDHowjklqT7H9IWK8oeD
Gq5hmxvMZKJQ529+gtar+6UmkjukvnxGlLNymm6E7wZAz27cfG9KZ9fU/9XPN0xt
S/pe6Qrbu1tpY7eTEyDFbW4vdka3q8M2A7Z3HqZqrU9Fy9PprAcSerL8UP7O1UA2
YvmWwc5JMcCYnaltHtwUbasc0abTZOw4wAeHd3nZKSAzuY3eo+/i42Yi83nHcfcc
njQVO5LQNr6cgZXxyfvjRjuD8tjb0y723ziNZnP0K8x8GgxKc28zZxFVXkIUfNdF
6qToQ/NewKx8cXoxzLiaqpi1NZyHw+YC+MjUiOxyoSxQybK3k43soTmd7G3oBLMd
qB6xhblJ6qZbh8JumukkyN2vXeYzNJaCh982cNzJpOoAdfTo59U=
=cbYB
-----END PGP SIGNATURE-----


Attachment: None (type=text/plain)