The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4368 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: Observable discrepancy leading to an information leak in the algorithm negotiation     (CVE-2020-14145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4368 advisory.

    - CVE-2020-14145 openssh: Observable Discrepancy leading to an information       leak in the algorithm negotiation (#1882252)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202105-35 (OpenSSH: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSH. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, able to access the socket of the forwarding agent,       might be able to execute arbitrary code with the privileges of the       process or cause a Denial of Service condition.
      Furthermore, a remote attacker might conduct a man-in-the-middle attack       targeting initial connection attempts where no host key for the server       has been cached by client yet.
  Workaround :

    There is no known workaround at this time.

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The client side in OpenSSH 5.7 through 8.3 has an     Observable Discrepancy leading to an information leak     in the algorithm negotiation. This allows     man-in-the-middle attackers to target initial     connection attempts (where no host key for the server     has been cached by the client).(CVE-2020-14145)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

CVE-2020-14145: Fixed an observable discrepancy leading to an information leak in the algorithm negotiation (bsc#1173513).

Fixed an issue where AuthorizedKeysCommand produced a lot of output (bsc#1161684).

Fixed an issue where oracle cluster with cluvfy using 'scp' failing/missinterpreted (bsc#1148566).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).

Fixed an issue where oracle cluster with cluvfy using 'scp' failing/missinterpreted (bsc#1148566).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
155126	RHEL 8 : openssh (RHSA-2021:4368)	Nessus	Red Hat Local Security Checks	11/11/2021	11/7/2024	medium
155394	Oracle Linux 8 : openssh (ELSA-2021-4368)	Nessus	Oracle Linux Local Security Checks	11/17/2021	10/23/2024	medium
157020	GLSA-202105-35 : OpenSSH: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	1/24/2022	1/26/2022	high
145734	EulerOS 2.0 SP8 : openssh (EulerOS-SA-2021-1159)	Nessus	Huawei Local Security Checks	2/1/2021	1/25/2024	medium
144351	SUSE SLES12 Security Update : openssh (SUSE-SU-2020:3844-1)	Nessus	SuSE Local Security Checks	12/17/2020	2/1/2024	medium
144501	SUSE SLES15 Security Update : openssh (SUSE-SU-2020:3882-1)	Nessus	SuSE Local Security Checks	12/21/2020	1/31/2024	medium
144037	SUSE SLED15 / SLES15 Security Update : openssh (SUSE-SU-2020:3736-1)	Nessus	SuSE Local Security Checks	12/10/2020	2/2/2024	medium

Detections

Analytics

Plugins Search

medium

medium

high

medium

medium

medium

medium