Score:-1

Ubuntu

Upgrade OpenSSH from v8.9 to v9.3 on 22.04.2 LTS?

Kat Fitzgerald

6/9/24, 3:16 PM

I'm working on shoring up some vulnerabilities in our environment, and one of them is that we're on OpenSSH 8.9. Our security team has advised us to upgrade to 9.3, but I'm not seeing anything indicating this package is available for Ubuntu 22.04. Is there any way to upgrade to that version?

2666

1 + 12

upgrade

ssh

security

openssh

Artur Meinild

6/9/24, 3:24 PM

Please obtain information about which CVE's they think need fixing, that aren't [included here](https://ubuntu.com/security/cves?q=&package=openssh). If they can't, I would suggest looking for a new security team that knows what they're talking about. Ubuntu patches LTS releases, so OpenSSH 8.9 in 22.04 should be at least as secure as any newer version.

Artur Meinild

6/9/24, 3:27 PM

Does this answer your question? [Why don't the Ubuntu repositories have the latest versions of software?](https://askubuntu.com/questions/151283/why-dont-the-ubuntu-repositories-have-the-latest-versions-of-software)

Thomas Ward

6/9/24, 4:10 PM

Your security team are likely relying **specifically** on scanner results, which are typically **incorrect**. Ubuntu patches CVEs with patches cherrypicked and applied to the **version in the Ubuntu repos** and to my knowledge there are no CVEs that are not already patched in the packaging. Check the CVE tracker for more details, and have your 'security team' learn not to rely solely on their tools, and to actually *check* if the CVEs, etc. they're seeing reported are in fact patched. (This is why we use Rapid7 InsightVM to check all our systems' security with credentialed agent access)

Thomas Ward

6/9/24, 4:11 PM

(Disclaimer: I'm an IT Security Professional myself AND *the* IT Sec person at my employer and we regularly see these 'false positives' in scans which don't have credentialed access to the systems to see what versions are actually installed and compare that against the known security patches that have been released)

Archisman Panigrahi

6/9/24, 4:20 PM

@ThomasWard-OnStrike These comments can be turned into an answer :)

Kat Fitzgerald

6/9/24, 4:40 PM

@ArturMeinild This is the CVE they're pointing to. We're on jammy right now which is marked as "needed". https://ubuntu.com/security/CVE-2023-28531 Reading that link, it looks like we just need to do the upgrade manually rather than via the ubuntu repos?

muru

6/9/24, 4:41 PM

Does this answer your question? [How can I tell if a CVE has been fixed in Ubuntu's repositories?](https://askubuntu.com/questions/563408/how-can-i-tell-if-a-cve-has-been-fixed-in-ubuntus-repositories)

Artur Meinild

6/9/24, 4:49 PM

Hmm this seems kinda strange - a CVE with priority "low" but severity score of 9.8?

Thomas Ward

6/9/24, 4:50 PM

@ArturMeinild CVE score != Ubuntu Security Team Assessment of Risk.,

Thomas Ward

6/9/24, 4:51 PM

@KatFitzgerald If you are specifically worried then you need to upgrade to a newer Ubuntu release. The moment you try and switch to a different OpenSSH system yourself on your infrastructure you lose general security support and now have to manually recompile every time there's a security issue, and you lose automated patching. You would probably have to upgrade to a newer Ubuntu release than what you're using.

Artur Meinild

6/9/24, 4:51 PM

Yeah, and I know way less than you about that - so thanks!

muru

6/13/24, 3:05 PM

@ArturMeinild also AIUI the intial CVE score is from the submitter and can be _inflated_ by self-important security types for reputation. Take [this CVE](https://web.archive.org/web/20220813234447/https://nvd.nist.gov/vuln/detail/CVE-2022-1927) which had a score of ***9.8*** (!) for *Vim* of all things. At the time security folks at my company were going nuts about it, and then I read [the bounty report](https://huntr.dev/bounties/945107ef-0b27-41c7-a03c-db99def0e777/), then ran the score calculator with what I felt were the right parameters and got 7.3 (close to the value it has _now_).

Score:3

Ubuntu

Thomas Ward

6/9/24, 4:24 PM

Your security team are likely relying specifically on scanner results, which are typically incorrect.

Ubuntu patches CVEs with patches cherrypicked and applied to the version in the Ubuntu repos and to my knowledge there are no CVEs that are not already patched in the packaging. Check the CVE tracker for more details, and have your 'security team' learn not to rely solely on their tools, and to actually check if the CVEs, etc. they're seeing reported are in fact patched. (This is why we use Rapid7 InsightVM to check all our systems' security with credentialed agent access at my employer).

Note that some CVEs are likely patched, while others don't apply, etc. so you and your sec team need to look up the specific CVEs on the tracker and see if the version of Ubuntu in use actually has a patch available. If it does, it'll list what version of the package has the patch. You can then check apt policy openssh-server and see what version of OpenSSH server is installed on the system. If it's older than the package version that's patched, you need to run updates on your systems.

(Disclaimer: I am an IT Security Professional by trade, and this 'misconception' of "you MUST upgrade to the latest OpenSSH or you're not safe!" is a notion that security teams need to stop adhering to, and they need to learn how the infrastructure actually works and gets updated.)

If you are dead set on updating to newer OpenSSH to fix this, then you need to manually compile OpenSSH and install it on those affected systems. This will not be trivial and is not easily documented here.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Upgrade OpenSSH from v8.9 to v9.3 on 22.04.2 LTS?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.