Amazon Linux 2023 Security Advisory: ALAS-2024-570
Advisory Release Date: 2024-03-13 20:41 Pacific
Advisory Updated Date: 2024-03-21 14:00 Pacific
Severity:
Medium
Issue Overview:
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name. (CVE-2023-51385)
Affected Packages:
openssh
Issue Correction:
Run dnf update openssh --releasever 2023.4.20240319 to update your system.
New Packages:
aarch64:
openssh-clients-debuginfo-8.7p1-8.amzn2023.0.10.aarch64
openssh-keycat-8.7p1-8.amzn2023.0.10.aarch64
openssh-debugsource-8.7p1-8.amzn2023.0.10.aarch64
openssh-clients-8.7p1-8.amzn2023.0.10.aarch64
openssh-server-debuginfo-8.7p1-8.amzn2023.0.10.aarch64
pam_ssh_agent_auth-debuginfo-0.10.4-4.8.amzn2023.0.10.aarch64
pam_ssh_agent_auth-0.10.4-4.8.amzn2023.0.10.aarch64
openssh-debuginfo-8.7p1-8.amzn2023.0.10.aarch64
openssh-keycat-debuginfo-8.7p1-8.amzn2023.0.10.aarch64
openssh-8.7p1-8.amzn2023.0.10.aarch64
openssh-server-8.7p1-8.amzn2023.0.10.aarch64
src:
openssh-8.7p1-8.amzn2023.0.10.src
x86_64:
openssh-clients-debuginfo-8.7p1-8.amzn2023.0.10.x86_64
openssh-server-debuginfo-8.7p1-8.amzn2023.0.10.x86_64
openssh-debugsource-8.7p1-8.amzn2023.0.10.x86_64
pam_ssh_agent_auth-0.10.4-4.8.amzn2023.0.10.x86_64
openssh-keycat-8.7p1-8.amzn2023.0.10.x86_64
openssh-debuginfo-8.7p1-8.amzn2023.0.10.x86_64
pam_ssh_agent_auth-debuginfo-0.10.4-4.8.amzn2023.0.10.x86_64
openssh-keycat-debuginfo-8.7p1-8.amzn2023.0.10.x86_64
openssh-clients-8.7p1-8.amzn2023.0.10.x86_64
openssh-8.7p1-8.amzn2023.0.10.x86_64
openssh-server-8.7p1-8.amzn2023.0.10.x86_64