openSUSE-SU-2019:0307-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2019:0307-1.json

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2019:0307-1

Related

Published

2019-03-23T11:09:55Z

Modified

2019-03-23T11:09:55Z

Summary

Security update for openssh

Details

This update for openssh fixes the following issues:

Security vulnerabilities addressed:

CVE-2019-6109: Fixed an character encoding issue in the progress display of the scp client that could be used to manipulate client output, allowing for spoofing during file transfers (bsc#1121816)
CVE-2019-6111: Properly validate object names received by the scp client to prevent arbitrary file overwrites when interacting with a malicious SSH server (bsc#1121821)

Other bug fixes and changes:

Handle brace expansion in scp when checking that filenames sent by the server side match what the client requested (bsc#1125687)

This update was imported from the SUSE:SLE-15:Update update project.

References

Affected packages

openSUSE:Leap 15.0 / openssh

Package

Name: openssh
Purl: pkg:rpm/opensuse/openssh&distro=openSUSE%20Leap%2015.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.6p1-lp150.8.15.2

Ecosystem specific

{
    "binaries": [
        {
            "openssh-askpass-gnome": "7.6p1-lp150.8.15.1",
            "openssh-cavs": "7.6p1-lp150.8.15.2",
            "openssh-fips": "7.6p1-lp150.8.15.2",
            "openssh-helpers": "7.6p1-lp150.8.15.2",
            "openssh": "7.6p1-lp150.8.15.2"
        }
    ]
}