Bug 104917 – CAN-2003-0786/0787 More OpenSSH vulnerabilities

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 104917 - CAN-2003-0786/0787 More OpenSSH vulnerabilities

Summary:	CAN-2003-0786/0787 More OpenSSH vulnerabilities

Status:	CLOSED NOTABUG

Aliases:	None

Product:	Red Hat Linux
Classification:	Retired
Component:	openssh (Show other bugs)
Sub Component:
Version:	9
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Nalin Dahyabhai
QA Contact:	Brian Brock
Docs Contact:

URL:
Whiteboard:
Keywords:	Security

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2003-09-23 11:16 EDT by Mark J. Cox
Modified:	2007-04-18 12:57 EDT (History)
CC List:	0 users

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2003-10-02 08:00:12 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Mark J. Cox 2003-09-23 11:16:59 EDT

http://www.openssh.com/txt/sshpam.adv came out on Sep23 with two new
vulnerabilities that affect OpenSSH.

Both these issues only affect OpenSSH 3.7 and 3.7.1.  Red Hat Linux and Red Hat
Enterprise Linux are not vulnerable to these issues as we ship with earlier
versions (with the addition of backported security fixes for other issues).

Keeping this bug open for a few days to enable users searching bugzilla to find
out that they are not vulnerable.

Comment 1 Mark J. Cox 2003-09-23 18:04:39 EDT

Just to clarify the above comment, (for some /. readers), we have not shipped 
a vulnerable version of OpenSSH either with the OS originally, or as part of 
any update errata provided since.  

(See https://rhn.redhat.com/errata/RHSA-2003-279.html and 
https://rhn.redhat.com/errata/RHSA-2003-280.html for the most current OpenSSH
updates, released on the 19th September).

Note You need to log in before you can comment on or make changes to this bug.