OpenSSH 爆高危漏洞 CVE-2024-6387

cnt2ex

4 天前

自从 xz 事件之后，我已经把监听地址限制在一个 VPN 的地址上了

darksheen

4 天前

看了下我的 almalinux 8 ，用的还是 8.0p1 呢

LingXingYue

4 天前

ubuntu 的软件源好像还没更新，可以自己手动编译安装，也很快
# 安装编译依赖
sudo apt-get update
sudo apt-get install -y build-essential zlib1g-dev libssl-dev

# 下载指定版本源码
wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.8p1.tar.gz

# 解压并进入目录
tar -xzf openssh-9.8p1.tar.gz
cd openssh-9.8p1

# 编译和安装
./configure
make
sudo make install

# 启动并检查安装
sudo systemctl restart ssh
ssh -V

cat

4 天前

@LingXingYue 不自己编译的话是不是只能等 apt 更新啊

chenluo0429

4 天前

睡前看到，顺手更新了

AstroProfundis

4 天前

别瞎搞，sudo make install 完就再也不用包管理更新了呗？

LeviMarvin

4 天前

ArchLinux 躺赢。OpenSSH_9.8p1, OpenSSL 3.3.1 4 Jun 2024

huagequan

4 天前

https://ubuntu.com/security/notices/USN-6859-1
Ubuntu 的软件源好像更新了

yukino

4 天前

@LeviMarvin openssh 最新版 9.8p1-1 ，该 `pacman -Syu` 了

FanChou

4 天前

Debian 11 12 已经修复了 https://security-tracker.debian.org/tracker/CVE-2024-6387

cat

4 天前

@huagequan apt update 还是没有，要怎么更新这个啊，求教

huagequan

4 天前

@cat 你是什么版本的 Ubuntu

yyzh

4 天前

@LingXingYue ubuntu 出紧急更新了

StinkyTofus

4 天前

我擦，赶紧升级呀

choury

4 天前

@cat 源里已经修了，要么你没加 security 仓库，要么你用的 mirror 同步有延迟
```
sudo apt upgrade
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
openssh-client openssh-server openssh-sftp-server ssh
4 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 1,687 kB of archives.
After this operation, 0 B of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 http://deb.debian.org/debian-security bookworm-security/main amd64 openssh-sftp-server amd64 1:9.2p1-2+deb12u3 [65.8 kB]
Get:2 http://deb.debian.org/debian-security bookworm-security/main amd64 openssh-server amd64 1:9.2p1-2+deb12u3 [456 kB]
Get:3 http://deb.debian.org/debian-security bookworm-security/main amd64 openssh-client amd64 1:9.2p1-2+deb12u3 [991 kB]
Get:4 http://deb.debian.org/debian-security bookworm-security/main amd64 ssh all 1:9.2p1-2+deb12u3 [174 kB]
Fetched 1,687 kB in 2min 20s (12.0 kB/s)
Reading changelogs... Done
Preconfiguring packages ...
(Reading database ... 94393 files and directories currently installed.)
Preparing to unpack .../openssh-sftp-server_1%3a9.2p1-2+deb12u3_amd64.deb ...
Unpacking openssh-sftp-server (1:9.2p1-2+deb12u3) over (1:9.2p1-2+deb12u2) ...
Preparing to unpack .../openssh-server_1%3a9.2p1-2+deb12u3_amd64.deb ...
Unpacking openssh-server (1:9.2p1-2+deb12u3) over (1:9.2p1-2+deb12u2) ...
Preparing to unpack .../openssh-client_1%3a9.2p1-2+deb12u3_amd64.deb ...
Unpacking openssh-client (1:9.2p1-2+deb12u3) over (1:9.2p1-2+deb12u2) ...
Preparing to unpack .../ssh_1%3a9.2p1-2+deb12u3_all.deb ...
Unpacking ssh (1:9.2p1-2+deb12u3) over (1:9.2p1-2+deb12u2) ...
Setting up openssh-client (1:9.2p1-2+deb12u3) ...
Setting up openssh-sftp-server (1:9.2p1-2+deb12u3) ...
Setting up openssh-server (1:9.2p1-2+deb12u3) ...

```

StinkyTofus

4 天前

Centos7.9 目前还是 OpenSSH_7.4p1 版本，是不是无敌了。不用升级了？

cat

4 天前

@choury @huagequan Ubuntu 22.04 的，已经把 source.list 切换成官方的了，依然没有……

sudo apt upgrade
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
Get more security updates through Ubuntu Pro with 'esm-apps' enabled:
gsasl-common libgsasl7
Learn more about Ubuntu Pro at https://ubuntu.com/pro
The following packages have been kept back:
cloud-init python3-update-manager ubuntu-advantage-tools ubuntu-pro-client ubuntu-pro-client-l10n
update-manager-core
0 upgraded, 0 newly installed, 0 to remove and 6 not upgraded.

huagequan

4 天前

@cat apt policy openssh-server 这个命令看看版本

cat

4 天前

@huagequan $ sudo apt policy openssh-server
openssh-server:
Installed: 1:8.9p1-3ubuntu0.10
Candidate: 1:8.9p1-3ubuntu0.10
Version table:
*** 1:8.9p1-3ubuntu0.10 500
500 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
500 http://security.ubuntu.com/ubuntu jammy-security/main amd64 Packages
100 /var/lib/dpkg/status
1:8.9p1-3 500
500 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages

Love4Taylor

4 天前

Arch 修了

https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/