Bug 2167636 (CVE-2023-25136)
| Summary: | CVE-2023-25136 openssh: the functions order_hostkeyalgs() and list_hostkey_types() leads to double-free vulnerability | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Sandipan Roy <saroy> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | dbelyavs, jjelen, psampaio |
| Target Milestone: | --- | Keywords: | Reopened, Security, Triaged |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in the OpenSSH server (sshd), which introduced a double-free vulnerability during options.kex_algorithms handling. An unauthenticated attacker can trigger the double-free in the default configuration.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-05-09 19:43:08 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2173667, 2173668, 2173669, 2186473, 2186474 | ||
| Bug Blocks: | 2166917, 2166920 | ||
|
Description
Sandipan Roy
2023-02-07 06:48:46 UTC
We don't have 9.1 neither in RHEL nor in Fedora so it's hardly relevant for us (In reply to Dmitry Belyavskiy from comment #2) > We don't have 9.1 neither in RHEL nor in Fedora so it's hardly relevant for > us Yes, All our Products are already marked as Not Affected and the CVE Page entry updated as well. This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2023-25136 Roy, could you please check whether it's just a self-DoS or it can be exploited via https://seclists.org/oss-sec/2023/q1/92 or smth similar? If it is a self-DoS, why does the presence of public exploit matter? *** Bug 2166785 has been marked as a duplicate of this bug. *** This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:2645 https://access.redhat.com/errata/RHSA-2023:2645 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2023-25136 |