A new flaw in OpenSSH can lead to remote code execution (securityaffairs.com)
from kid@sh.itjust.works to cybersecurity@sh.itjust.works on 11 Jul 2024 12:15
https://sh.itjust.works/post/22095926

#cybersecurity

threaded - newest

devilish666@lemmy.world on 11 Jul 2024 14:00 next collapse

Flashback xz package in linux getting louder and louder

infeeeee@lemm.ee on 11 Jul 2024 17:50 collapse

xz was a deliberate supply chain attack this is just a bug, accidental, not a rhel backdoor

infeeeee@lemm.ee on 11 Jul 2024 16:03 collapse

The CVE-2024-6409 vulnerability affects only the sshd server shipped in RHEL 9, while the upstream versions of sshd are not impacted.

Yes, only RHEL based releases affected (source):

Specifically, openssh-7.6p1-audit.patch found in Red Hat’s package of OpenSSH adds code to cleanup_exit() that exposes the issue. Relevantly, this patch is found in RHEL 9 (and its rebuild/downstream distributions), where the package is based on OpenSSH 8.7p1.

Debian oldstable is safe from this as well

sugar_in_your_tea@sh.itjust.works on 11 Jul 2024 22:46 collapse

Looks like openSUSE Leap is fine, not sure about other SUSE distros.