Opened 10 months ago

Closed 10 months ago

Last modified 10 months ago

#18770 closed bug (fixed)

SSH Terrapin Prefix Truncation Weakness (CVE-2023-48795)

Reported by: Coldfirex Owned by: nobody
Priority: normal Milestone: Unscheduled
Component: Network & Internet Version: R1/beta4
Keywords: Cc:
Blocked By: Blocking:
Platform: All

Description

I scanned latet nightly (hrev57531), that has SSH server enabled, with Tenable and it came back as affected by Terrapin.

Looks like we should disable some ssh ciphers to workaround this.

​https://www.tenable.com/plugins/nessus/187315 ​https://www.linuxglobal.com/thwarting-the-terrapin-ssh-attack/

Change History (5)

comment:1 by waddlesplash, 10 months ago

Or we should just upgrade OpenSSH and let it use whatever defaults it finds suitable?

comment:2 by Coldfirex, 10 months ago

That too. Looks like 9.6 has the changes built in.

comment:3 by begasus, 10 months ago

PR for 9.6p1 is up at: ​https://github.com/haikuports/haikuports/pull/10029 Still need to check 32bit, but quick run seems promising on 64bit.

comment:4 by waddlesplash, 10 months ago

Resolution: → fixed
Status: new → closed

Now merged and built.

comment:5 by Coldfirex, 10 months ago

Confirmed all good with another Nessus scan. Thanks!

Note: See TracTickets for help on using tickets.