Bug 1375179 – [RFE] RC4 and CBC ciphers shipped with openssh and openssh-server should be removed

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1375179 - [RFE] RC4 and CBC ciphers shipped with openssh and openssh-server should be removed

Summary:	[RFE] RC4 and CBC ciphers shipped with openssh and openssh-server should be r...

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	openssh (Show other bugs)
Sub Component:
Version:	7.2
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	rc
Target Release:	7.4
Assigned To:	Jakub Jelen
QA Contact:	Hubert Kario
Docs Contact:

URL:
Whiteboard:
Keywords:	FutureFeature

Depends On:
Blocks:	1377248 1335929
	Show dependency tree / graph

Reported:	2016-09-12 08:04 EDT by Muhammad Azhar Shaikh
Modified:	2017-08-01 14:42 EDT (History)
CC List:	4 users (show)

See Also:
Fixed In Version:	openssh-7.4p1-1.el7
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-08-01 14:42:47 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Knowledge Base (Solution)	420283	None	None	None	2016-09-12 08:05 EDT
Red Hat Product Errata	RHSA-2017:2029	normal	SHIPPED_LIVE	Moderate: openssh security, bug fix, and enhancement update	2017-08-01 14:11:55 EDT

Groups: None (edit)

Comment 2 Jakub Jelen 2016-09-14 07:16:01 EDT

Basically the same request is in the bug #1373836 (for RHEL6.9 now). We are aware of this issue and we plan to proceed with removing insecure algorithms in future releases.

Comment 4 Chris Blum 2017-01-01 07:11:20 EST

While we're at it - can we also remove the arcfour ciphers?
My security scanner (Greenbone) reports:

> Vulnerability Insight
> The ‘arcfour‘ cipher is the Arcfour stream cipher with 128-bit keys. The Arcfour cipher is believed to be
> compatible with the RC4 cipher {[}SCHNEIER{]}. Arcfour (and RC4) has problems with weak keys, and
> should not be used anymore.

Currently this is not yet reflected on the customer portal:
https://access.redhat.com/solutions/420283

But I don't know where I would let them know... So I came here ;)

Comment 10 errata-xmlrpc 2017-08-01 14:42:47 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2017:2029

Note You need to log in before you can comment on or make changes to this bug.