Alan D. Salewski via plug on 1 Jul 2024 14:17:35 -0700


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] recent vulnerability in OpenSSH 

On 2024-07-01 16:31:59, Martin Cracauer via plug <plug@lists.phillylinux.org> spake thus:

Alan D. Salewski via plug wrote on Mon, Jul 01, 2024 at 04:25:46PM -0400:

[...]

Have been hunting ssh demons all day.  Is it normal for Debian's
unattended updates to not work as expected?

Martin


I don't use the unattended updates feature, but maybe check the
scheduling frequency of that process.

Also confirm that the 'bookworm-security' repository is
configured. Is you're running Debian 12.x ("bookworm"), the fix is
in version 1:9.2p1-2+deb12u3 of the openssh-server package[0].

    # apt-cache policy openssh-server
    openssh-server:
      Installed: 1:8.4p1-5+deb11u3
      Candidate: 1:8.4p1-5+deb11u3
      Version table:
         1:9.7p1-7 80
             80 https://deb.debian.org/debian sid/main amd64 Packages
         1:9.2p1-2+deb12u3 500
            500 https://security.debian.org/debian-security bookworm-security/main amd64 Packages
            500 https://deb.debian.org/debian bookworm-proposed-updates/main amd64 Packages
         1:9.2p1-2+deb12u2 500
            500 https://deb.debian.org/debian bookworm/main amd64 Packages
    ...


[0] https://security-tracker.debian.org/tracker/CVE-2024-6387

--
a l a n   d.   s a l e w s k i
ads@salewski.email
salewski@att.net
https://github.com/salewski
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug