Bug 32672

Summary: CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack) - putty
Product: Mageia Reporter: Marja Van Waes <marja11>
Component: SecurityAssignee: QA Team <qa-bugs>
Status: RESOLVED FIXED QA Contact: Sec team <security>
Severity: critical    
Priority: Normal CC: andrewsfarm, brtians1, herman.viaene, lewyssmith, marja11, nicolas.salguero, pkg-bugs, security, sysadmin-bugs, yvesbrungard
Version: 9Keywords: advisory, validated_update
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard: MGA9-64-OK
Source RPM: putty CVE: CVE-2023-48795
Status comment:
Bug Depends on:    
Bug Blocks: 32641    

Description Marja Van Waes 2023-12-31 17:56:08 CET 
+++ This bug was initially created as a clone of Bug #32641 +++

That CVE was announced here:
https://www.openwall.com/lists/oss-security/2023/12/18/3
https://www.openwall.com/lists/oss-security/2023/12/19/5
https://www.openwall.com/lists/oss-security/2023/12/20/3

Many SSH implementations that are packaged in Mageia are affected:
<snip>
  - putty

0.80 is the version that fixes the issue https://www.chiark.greenend.org.uk/~sgtatham/putty/

daviddavid already updated putty in cauldron to that version.
Comment 1 Marja Van Waes 2023-12-31 18:00:25 CET 
@ daviddavid

Since you fixed this for cauldron, I assume you're OK with fixing it in Mageia 9, too

Assignee: bugsquad => geiger.david68210

Marja Van Waes 2024-01-02 12:00:49 CET

CVE: (none) => CVE-2023-48795

Comment 2 papoteur 2024-01-02 13:41:42 CET 
An update is submitted:
RPMS: putty-0.80-1.mga9
Source:putty-0.80-1.mga9

Assignee: geiger.david68210 => qa-bugs

Comment 3 Marja Van Waes 2024-01-02 14:11:54 CET 
(In reply to papoteur from comment #2)

> Source:putty-0.80-1.mga9

Advisory with SRPM from comment 2 added to SVN. Please remove the "advisory" keyword if it needs to be changed. It also helps when obsolete advisories are tagged as "obsolete"

Keywords: (none) => advisory

Comment 4 Herman Viaene 2024-01-03 14:46:04 CET 
MGA9-64 Plasma Wayland on HP Pavillion
No installation issues.
Ref bug 28943 for testing, but putty seems to react differently
$ putty -l prutser <desktopPC>
PuTTY: unable to load font "server:fixed"
Googling learned me:
$ env GDK_BACKEND=x11 putty -X -l prutser <desktopPC>
libuim: [fatal] dynlib: /usr/lib64/uim/plugin/libuim-sqlite3.so: undefined symbol: uim_scm_c_int: Load failed.
Session on <desktopPC> opens at CLI and that works OK, but I find no way of opening an X-session in this way.

Note: <desktopPC> runs M9 Plasma X11
If someone can get X-conncetionn running, I'll agree on the OK.

CC: (none) => herman.viaene

Comment 5 Brian Rockwell 2024-01-03 19:25:27 CET 
MGA9-64 Plasma

No installation issues.

I was able to connect via SSH to server, worked as expected.
Set up profile - that worked

I don't have anything I can try connecting as an X-Session at the moment, so this will have to wait on someone else or when I get some time.

But, it works for me.

CC: (none) => brtians1

Comment 6 Brian Rockwell 2024-01-04 17:07:16 CET 
MGA9-64 Plasma

on server installed and started sshd, open ssh port, installed xclock


# urpmi xclock
# urpmi sshd
# systemctl start sshd
# systemctl status sshd

through putty I am able to connect to ssh server

$ clock on ssh session pops up the xclock app

Working as designed.

Whiteboard: (none) => MGA9-64-OK

Comment 7 Thomas Andrews 2024-01-04 22:02:49 CET 
Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 8 Mageia Robot 2024-01-08 11:14:27 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0003.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED

Nicolas Salguero 2024-01-19 16:12:02 CET

Blocks: (none) => 32748

Nicolas Salguero 2024-01-19 16:16:44 CET

Blocks: 32748 => (none)