CVE-2024-39894

OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.

OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.

OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.

These are all security issues fixed in the openssh-9.6p1-11.1 package on the GA media of openSUSE Tumbleweed.

This update for openssh fixes the following issues:

Security fixes:

• CVE-2024-39894: Fixed timing attacks against echo-off password entry (bsc#1227318).

Other fixes:

• Add obsoletes for openssh-server-config-rootlogin (bsc#1227350).
• Add #include <stdlib.h> in some files added by the ldap patch to fix build with gcc14 (bsc#1225904).
• Remove the recommendation for openssh-server-config-rootlogin from openssh-server (bsc#1224392).

This update for openssh fixes the following issues:

• CVE-2024-39894: Fixed timing attacks against echo-off password entry (bsc#1227318)
• CVE-2024-6387: Fixed race condition in a signal handler (bsc#1226642).

Philippos Giavridis, Jacky Wei En Kung, Daniel Hugenroth, and Alastair Beresford discovered that the OpenSSH ObscureKeystrokeTiming feature did not work as expected. A remote attacker could possibly use this issue to determine timing information about keystrokes.