The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:4368 advisory.

  - The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in     the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts     (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and     8.6 are also affected. (CVE-2020-14145)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 16.1.4 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K48050136 advisory.

  - The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in     the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts     (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and     8.6 are also affected. (CVE-2020-14145)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:4368 advisory.

  - The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in     the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts     (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and     8.6 are also affected. (CVE-2020-14145)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202105-35 (OpenSSH: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSH. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, able to access the socket of the forwarding agent,       might be able to execute arbitrary code with the privileges of the       process or cause a Denial of Service condition.
      Furthermore, a remote attacker might conduct a man-in-the-middle attack       targeting initial connection attempts where no host key for the server       has been cached by client yet.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4368 advisory.

  - The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in     the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts     (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and     8.6 are also affected. (CVE-2020-14145)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4368 advisory.

  - openssh: Observable discrepancy leading to an information leak in the algorithm negotiation     (CVE-2020-14145)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4368 advisory.

  - openssh: Observable discrepancy leading to an information leak in the algorithm negotiation     (CVE-2020-14145)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - ssh-agent in OpenSSH before 8.5 has a double free that     may be relevant in a few less-common scenarios, such as     unconstrained agent-socket access on a legacy operating     system, or the forwarding of an agent to an     attacker-controlled host.(CVE-2021-28041)

  - A flaw was found in OpenSSH in versions 5.7 through     8.3, where an Observable Discrepancy occurs and leads     to an information leak in the algorithm negotiation.
    This flaw allows a man-in-the-middle attacker to target     initial connection attempts, where there is no host key     for the server that has been cached by the     client.(CVE-2020-14145)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The client side in OpenSSH 5.7 through 8.4 has an     Observable Discrepancy leading to an information leak     in the algorithm negotiation. This allows     man-in-the-middle attackers to target initial     connection attempts (where no host key for the server     has been cached by the client).(CVE-2020-14145)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openssh packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - The client side in OpenSSH 5.7 through 8.3 has an     Observable Discrepancy leading to an information leak     in the algorithm negotiation. This allows     man-in-the-middle attackers to target initial     connection attempts (where no host key for the server     has been cached by the client).(CVE-2020-14145)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The client side in OpenSSH 5.7 through 8.3 has an     Observable Discrepancy leading to an information leak     in the algorithm negotiation. This allows     man-in-the-middle attackers to target initial     connection attempts (where no host key for the server     has been cached by the client).(CVE-2020-14145)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openssh packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - The client side in OpenSSH 5.7 through 8.4 has an     Observable Discrepancy leading to an information leak     in the algorithm negotiation. This allows     man-in-the-middle attackers to target initial     connection attempts (where no host key for the server     has been cached by the client).(CVE-2020-14145)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The client side in OpenSSH 5.7 through 8.3 has an     Observable Discrepancy leading to an information leak     in the algorithm negotiation. This allows     man-in-the-middle attackers to target initial     connection attempts (where no host key for the server     has been cached by the client).(CVE-2020-14145)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

  - CVE-2020-14145: Fixed a potential information leak     during host key exchange (bsc#1173513).

  - Supplement libgtk-3-0 instead of libX11-6 to avoid     installation on a textmode install (bsc#1142000)

  - Fixed an issue where oracle cluster with cluvfy using     'scp' failing/missinterpreted (bsc#1148566).

  - Fixed sshd termination of multichannel sessions with     non-root users (bsc#1115550,bsc#1174162).

  - Added speculative hardening for key storage     (bsc#1139398). 

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for openssh fixes the following issues :

CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).

Fixed an issue where oracle cluster with cluvfy using 'scp' failing/missinterpreted (bsc#1148566).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).

Supplement libgtk-3-0 instead of libX11-6 to avoid installation on a textmode install (bsc#1142000)

Fixed an issue where oracle cluster with cluvfy using 'scp' failing/missinterpreted (bsc#1148566).

Fixed sshd termination of multichannel sessions with non-root users (bsc#1115550,bsc#1174162).

Added speculative hardening for key storage (bsc#1139398).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

CVE-2020-14145: Fixed an observable discrepancy leading to an information leak in the algorithm negotiation (bsc#1173513).

Fixed an issue where AuthorizedKeysCommand produced a lot of output (bsc#1161684).

Fixed an issue where oracle cluster with cluvfy using 'scp' failing/missinterpreted (bsc#1148566).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

  - CVE-2020-14145: Fixed a potential information leak     during host key exchange (bsc#1173513).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

ID	Name	Product	Family	Severity
184641	Rocky Linux 8 : openssh (RLSA-2021:4368)	Nessus	Rocky Linux Local Security Checks	medium
166567	F5 Networks BIG-IP : OpenSSH client vulnerability (K48050136)	Nessus	F5 Networks Local Security Checks	medium
157667	AlmaLinux 8 : openssh (ALSA-2021:4368)	Nessus	Alma Linux Local Security Checks	medium
157020	GLSA-202105-35 : OpenSSH: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
155394	Oracle Linux 8 : openssh (ELSA-2021-4368)	Nessus	Oracle Linux Local Security Checks	medium
155340	CentOS 8 : openssh (CESA-2021:4368)	Nessus	CentOS Local Security Checks	medium
155126	RHEL 8 : openssh (RHSA-2021:4368)	Nessus	Red Hat Local Security Checks	medium
148637	EulerOS Virtualization 2.9.0 : openssh (EulerOS-SA-2021-1746)	Nessus	Huawei Local Security Checks	high
148631	EulerOS Virtualization 2.9.1 : openssh (EulerOS-SA-2021-1720)	Nessus	Huawei Local Security Checks	high
148058	EulerOS 2.0 SP5 : openssh (EulerOS-SA-2021-1694)	Nessus	Huawei Local Security Checks	medium
147613	EulerOS Virtualization for ARM 64 3.0.2.0 : openssh (EulerOS-SA-2021-1398)	Nessus	Huawei Local Security Checks	medium
147538	EulerOS Virtualization 3.0.2.6 : openssh (EulerOS-SA-2021-1445)	Nessus	Huawei Local Security Checks	medium
147125	EulerOS Virtualization 3.0.6.6 : openssh (EulerOS-SA-2021-1504)	Nessus	Huawei Local Security Checks	medium
147077	EulerOS Virtualization for ARM 64 3.0.6.0 : openssh (EulerOS-SA-2021-1541)	Nessus	Huawei Local Security Checks	medium
146263	EulerOS 2.0 SP9 : openssh (EulerOS-SA-2021-1251)	Nessus	Huawei Local Security Checks	medium
146262	EulerOS 2.0 SP9 : openssh (EulerOS-SA-2021-1270)	Nessus	Huawei Local Security Checks	medium
145734	EulerOS 2.0 SP8 : openssh (EulerOS-SA-2021-1159)	Nessus	Huawei Local Security Checks	medium
145297	openSUSE Security Update : openssh (openSUSE-2020-2298)	Nessus	SuSE Local Security Checks	medium
144760	SUSE SLES12 Security Update : openssh (SUSE-SU-2021:0022-1)	Nessus	SuSE Local Security Checks	medium
144501	SUSE SLES15 Security Update : openssh (SUSE-SU-2020:3882-1)	Nessus	SuSE Local Security Checks	medium
144445	SUSE SLED15 / SLES15 Security Update : openssh (SUSE-SU-2020:3866-1)	Nessus	SuSE Local Security Checks	medium
144351	SUSE SLES12 Security Update : openssh (SUSE-SU-2020:3844-1)	Nessus	SuSE Local Security Checks	medium
144312	openSUSE Security Update : openssh (openSUSE-2020-2240)	Nessus	SuSE Local Security Checks	medium
144037	SUSE SLED15 / SLES15 Security Update : openssh (SUSE-SU-2020:3736-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2020-14145

medium

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium