0

Currently using Amazon Linux 2, and our VA tool is stating that it has found multiple vulnerabilites with openSSH7.4p1, stating that the vulnerabilities have been patched with a later version of OpenSSH. The issue that i find is that when I try to run a yum update for openssh, it comes back with the message that there are no packages for update. So, the question that I have is this: Does OpenSSH 7.4p1 have any vulnerabilities as of May 16,2023?

CVEs in question: CVE-2020-15778 CVE-2021-41617 CVE-2019-6109 CVE-2019-6110 and more.

User51432
  • 1
  • What is the output of rpm -qa | grep openssh-7.4p1? – Thegs May 16 '23 at 19:54
  • To add slightly: the 'openssh-7.4p1-something' package in RH/Fedora/CentOS/Amazon/etc (and also other stable distros like Debian/Ubuntu/Mint) is not identical to upstream 7.4p1; it has patches applied to it, mostly security fixes backported from later upstream versions. The package version (shown by rpm yum dnf etc) changes to reflect these patches, but the version string in the source and compiled code remains the same as upstream, and that's the version seen by an external scanner and used to make incorrect vulnerability assessments. – dave_thompson_085 May 17 '23 at 00:54

1 Answers1

1

Amazon Linux 2 is closely related to CentOS 7 which is the open source rebranding of RedHat Enterprise Linux 7.

Since RHEL likes to use stable packages, they usually take it upon themselves to make sure that the versions of software they use get all of the important security updates of later releases.

This can be seen in any RPM package using the --changelog query option of rpm command. The output is quite long, so we will limit the output with a grep for CVE's after 2000:

rpm -q --changelog openssh | grep CVE-20

In the case of the most recent release of openssh-7.4p1, I can see that CVE-2021-41617 from your list has been addressed with a fix on September 30 2021. If you are asking "what was the fix for that CVE?" or "what about the other CVEs in the list?", you can find such answers in the RHEL documentation for CVEs

If you look at CVE-2020-15778, CVE-2019-6109, and CVE-2019-6110 they are listed as "will not fix" and give reasoning why a fix will not be provided.

These types of security scans usually only look at the version number of installed software and compare that with a catalog of known CVEs but do not attempt to discover if the software is actually affected by any of those vulnerabilities. If you are using an in-support, up-to-date distribution, chances are any major vulnerabilities have been or will be fixed.

GracefulRestart
  • 4,901