SUSE-SU-2018:3686-1: moderate: Security update for openssh

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for openssh
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:3686-1
Rating:             moderate
References:         #1081947 #1091396 #1105010 #1106163 #964336 
                    
Cross-References:   CVE-2018-15473 CVE-2018-15919
Affected Products:
                    SUSE Linux Enterprise Module for Server Applications 15
                    SUSE Linux Enterprise Module for Open Buildservice Development Tools 15
                    SUSE Linux Enterprise Module for Desktop Applications 15
                    SUSE Linux Enterprise Module for Basesystem 15
______________________________________________________________________________

   An update that solves two vulnerabilities and has three
   fixes is now available.

Description:

   This update for openssh fixes the following issues:

   - CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH
     could be used by remote attackers to detect existence of users on a
     target system when GSS2 is in use. OpenSSH developers do not want to
     treat such a username enumeration (or "oracle") as a vulnerability.
     (bsc#1106163)
   - CVE-2018-15473: OpenSSH was prone to a user existance oracle
     vulnerability due to not delaying bailout for an invalid authenticating
     user until after the packet containing the request has been fully
     parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
     (bsc#1105010)

   The following non-security issues were fixed:

   - Stop leaking File descriptors (bsc#964336)
   - sftp-client.c returns wrong error code upon failure (bsc#1091396)
   - added pam_keyinit to pam configuration file (bsc#1081947)


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for Server Applications 15:

      zypper in -t patch SUSE-SLE-Module-Server-Applications-15-2018-2619=1

   - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15:

      zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-2018-2619=1

   - SUSE Linux Enterprise Module for Desktop Applications 15:

      zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-2018-2619=1

   - SUSE Linux Enterprise Module for Basesystem 15:

      zypper in -t patch SUSE-SLE-Module-Basesystem-15-2018-2619=1



Package List:

   - SUSE Linux Enterprise Module for Server Applications 15 (aarch64 ppc64le s390x x86_64):

      openssh-debuginfo-7.6p1-9.3.1
      openssh-debugsource-7.6p1-9.3.1
      openssh-fips-7.6p1-9.3.1

   - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (aarch64 ppc64le s390x x86_64):

      openssh-cavs-7.6p1-9.3.1
      openssh-cavs-debuginfo-7.6p1-9.3.1
      openssh-debuginfo-7.6p1-9.3.1
      openssh-debugsource-7.6p1-9.3.1

   - SUSE Linux Enterprise Module for Desktop Applications 15 (aarch64 ppc64le s390x x86_64):

      openssh-askpass-gnome-7.6p1-9.3.1
      openssh-askpass-gnome-debuginfo-7.6p1-9.3.1

   - SUSE Linux Enterprise Module for Basesystem 15 (aarch64 ppc64le s390x x86_64):

      openssh-7.6p1-9.3.1
      openssh-debuginfo-7.6p1-9.3.1
      openssh-debugsource-7.6p1-9.3.1
      openssh-helpers-7.6p1-9.3.1
      openssh-helpers-debuginfo-7.6p1-9.3.1


References:

   https://www.suse.com/security/cve/CVE-2018-15473.html
   https://www.suse.com/security/cve/CVE-2018-15919.html
   https://bugzilla.suse.com/1081947
   https://bugzilla.suse.com/1091396
   https://bugzilla.suse.com/1105010
   https://bugzilla.suse.com/1106163
   https://bugzilla.suse.com/964336