CVE-2020-14145

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. In addition, OpenSSH provides a large suite of secure tunneling capabilities, several authentication methods, and sophisticated configuration options.

Security Fix(es):

The client side in OpenSSH 5.7 through 8.3 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).(CVE-2020-14145)

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es):

• openssh: Observable discrepancy leading to an information leak in the algorithm negotiation (CVE-2020-14145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es):

• openssh: Observable discrepancy leading to an information leak in the algorithm negotiation (CVE-2020-14145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The client side in OpenSSH 5.7 through 8.3 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client) (CVE-2020-14145).

This update for openssh fixes the following issues:

• CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for openssh fixes the following issues:

• CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).
• Supplement libgtk-3-0 instead of libX11-6 to avoid installation on a textmode install (bsc#1142000)
• Fixed an issue where oracle cluster with cluvfy using 'scp' failing/missinterpreted (bsc#1148566).
• Fixed sshd termination of multichannel sessions with non-root users (bsc#1115550,bsc#1174162).
• Added speculative hardening for key storage (bsc#1139398).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for openssh fixes the following issues:

• CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).

This update for openssh fixes the following issues:

• CVE-2020-14145: Fixed an observable discrepancy leading to an information leak in the algorithm negotiation (bsc#1173513).
• Fixed an issue where AuthorizedKeysCommand produced a lot of output (bsc#1161684).
• Fixed an issue where oracle cluster with cluvfy using 'scp' failing/missinterpreted (bsc#1148566).

This update for openssh fixes the following issues:

• CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).
• Supplement libgtk-3-0 instead of libX11-6 to avoid installation on a textmode install (bsc#1142000)
• Fixed an issue where oracle cluster with cluvfy using 'scp' failing/missinterpreted (bsc#1148566).
• Fixed sshd termination of multichannel sessions with non-root users (bsc#1115550,bsc#1174162).
• Added speculative hardening for key storage (bsc#1139398).

This update for openssh fixes the following issues:

• CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).
• Fixed an issue where oracle cluster with cluvfy using 'scp' failing/missinterpreted (bsc#1148566).

This update for openssh fixes the following issues:

• CVE-2020-14145: Fixed a potential information leak during host key exchange (bsc#1173513).