4

I am using qualys for security scan on Ubuntu 14.04 LTS. It is reporting these vulnerabilities CVE-2016-8858,CVE-2016-10009,CVE-2016-10010,CVE-2016-10011,CVE-2016-10012 which require openssh 7.4 .

This is a serious thing for us which is stopping us from being compliant. I want to know if there is an official way to update OpenSSH version to 7.4 in ubuntu 14 (https://stackoverflow.com/questions/36453976/upgrade-openssh-7-2p-in-ubuntu-14-04), or by when should I expect ubuntu to release security patches for these vulnerabilities.

Improve this question

2 Answers 2

Reset to default
3

Installing OpenSSH 7.4 on Ubuntu 14.04

sudo apt install -y build-essential libssl-dev zlib1g-dev
wget "https://fastly.cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.4p1.tar.gz"
tar xfz openssh-7.4p1.tar.gz
cd openssh-7.4p1
./configure
make
sudo make install && sudo service ssh restart && ssh -V
Improve this answer
1
  • 1
    Take care: ./configure uses directories under /usr/local which isn't the "standard" location for ubuntu
    – lrkwz
    Sep 1, 2022 at 14:22
0

There is no official way to upgrade OpenSSH to 7.4 in Ubuntu 14.04, and since thuse bugs from 2016 are not yet fixed, they are probably considered very low priority and expecting them to be fixed in any timeframe is probably unreasonable.

In any case, if security is so important to you, you should hire someone who knows what they are doing; they can build you a 7.4 package very easily.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .