Bug 32675 - CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Attack) -apache-sshd
Summary: CVE-2023-48795: Prefix Truncation Attacks in SSH Specification (Terrapin Atta...
Status: NEW
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: Nicolas Lécureuil
QA Contact: Sec team
URL:
Whiteboard: MGA9TOO
Keywords:
Depends on:
Blocks: 32641
  Show dependency tree / graph
 
Reported: 2023-12-31 18:26 CET by Marja Van Waes
Modified: 2024-02-17 10:24 CET (History)
9 users (show)

See Also:
Source RPM: apache-sshd-2.8.0-1.mga9
CVE: CVE-2023-48795
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Marja Van Waes 2023-12-31 18:26:51 CET 
+++ This bug was initially created as a clone of Bug #32641 +++

That CVE was announced here:
https://www.openwall.com/lists/oss-security/2023/12/18/3
https://www.openwall.com/lists/oss-security/2023/12/19/5
https://www.openwall.com/lists/oss-security/2023/12/20/3

Many SSH implementations that are packaged in Mageia are affected:
<snip>
  - apache-sshd

https://github.com/apache/mina-sshd/issues/445 about Terrapin is still open now.
Marja Van Waes 2023-12-31 18:27:22 CET

Whiteboard: (none) => MGA9TOO

Marja Van Waes 2024-01-02 11:59:48 CET

CVE: (none) => CVE-2023-48795

Nicolas Salguero 2024-01-19 16:12:02 CET

Blocks: (none) => 32748

Nicolas Salguero 2024-01-19 16:16:44 CET

Blocks: 32748 => (none)

papoteur 2024-02-15 20:57:21 CET

CC: (none) => mageia

Comment 1 Marc Krämer 2024-02-17 10:24:19 CET 
@papoteur: how can I help?
Note You need to log in before you can comment on or make changes to this bug.