Ubuntu
openssh package

  1. Bug #2030275
  2. Comment #5

Comment 5 for bug 2030275

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package openssh - 1:8.2p1-4ubuntu0.9

---------------
openssh (1:8.2p1-4ubuntu0.9) focal-security; urgency=medium

  * SECURITY UPDATE: information leak in algorithm negotiation (LP: #2030275)
    - debian/patches/CVE-2020-14145-mitigation.patch: tweak the client
      hostkey preference ordering algorithm in sshconnect2.c.
    - Note: This update does not solve CVE-2020-14145, but does mitigate
      the issue in the specific scenario where the user has a key that
      matches the best-preference default algorithm.

 -- Marc Deslauriers <email address hidden> Fri, 04 Aug 2023 18:02:08 -0400