I am running Ubuntu 20.04.2 LTS and am using the system as a web server. I update the system on a regular basis.
I am trying to make sure my system is as secure as possible and have started to test the system. I ran a vulnerability scan on my system using NMAP. The results showed that there were some vulnerabilities in OpenSSH_8.2 and I was wondering if they were false-positives. The OpenSSH website says that the latest version is 8.6 but when I update my system, the repositories say that OpenSSH_8.2 is the most up to date version.
Do you build your own updates for packages? I was wondering since the OpenSSH_8.6 says it takes care of the vulnerabilities listed in the NMAP scan.
Sorry I didn't give more info about what my situation was about. This is in response to some of the comments and answer. I haven't submitted this through Launchpad for the security team to look at because I believe this is something that OpenSSH has already posted alerts on their site about everything I found.
So, a little bit more background. I ran the NMAP scan on my own LAN. I scanned my Ubuntu server from another computer running Kali Linux. I have my Kali and Ubuntu computers hardwired into my router (ethernet). I have configured my computers and router to allow SSH connections from certain computers on my LAN and completely blocked to WAN.
Like I say, the computer I scanned is Ubuntu:
~$ lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 20.04.2 LTS Release: 20.04 Codename: focal
~$ ssh -V OpenSSH_8.2p1 Ubuntu-4ubuntu0.2, OpenSSL 1.1.1f 31 Mar 2020
The command I used for scanning and results from said scan:
─$ sudo nmap -sV --script vuln 192.168.0.12 Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-24 21:13 PDT Pre-scan script results: | broadcast-avahi-dos: | Discovered hosts: | 184.108.40.206 | After NULL UDP avahi packet DoS (CVE-2011-1002). |_ Hosts are all up (not vulnerable). Nmap scan report for 192.168.0.12 Host is up (0.00016s latency). Not shown: 995 filtered ports PORT STATE SERVICE VERSION 20/tcp closed ftp-data 21/tcp closed ftp 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0) | vulners: | cpe:/a:openbsd:openssh:8.2p1: | EDB-ID:21018 10.0 https://vulners.com/exploitdb/EDB-ID:21018 *EXPLOIT* | CVE-2001-0554 10.0 https://vulners.com/cve/CVE-2001-0554 | CVE-2020-15778 6.8 https://vulners.com/cve/CVE-2020-15778 | CVE-2020-12062 5.0 https://vulners.com/cve/CVE-2020-12062 | CVE-2021-28041 4.6 https://vulners.com/cve/CVE-2021-28041 | MSF:ILITIES/OPENBSD-OPENSSH-CVE-2020-14145/ 4.3 https://vulners.com/metasploit/MSF:ILITIES/OPENBSD-OPENSSH-CVE-2020-14145/ *EXPLOIT* | MSF:ILITIES/HUAWEI-EULEROS-2_0_SP9-CVE-2020-14145/ 4.3 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP9-CVE-2020-14145/ *EXPLOIT* | MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2020-14145/ 4.3 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2020-14145/ *EXPLOIT* | MSF:ILITIES/HUAWEI-EULEROS-2_0_SP5-CVE-2020-14145/ 4.3 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP5-CVE-2020-14145/ *EXPLOIT* | MSF:ILITIES/F5-BIG-IP-CVE-2020-14145/ 4.3 https://vulners.com/metasploit/MSF:ILITIES/F5-BIG-IP-CVE-2020-14145/ *EXPLOIT* | CVE-2020-14145 4.3 https://vulners.com/cve/CVE-2020-14145 |_ MSF:AUXILIARY/SCANNER/SSH/FORTINET_BACKDOOR/ 0.0 https://vulners.com/metasploit/MSF:AUXILIARY/SCANNER/SSH/FORTINET_BACKDOOR/ *EXPLOIT* 80/tcp open http Apache httpd |_http-csrf: Couldn't find any CSRF vulnerabilities. |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-server-header: Apache |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. 443/tcp open ssl/http Apache httpd |_http-csrf: Couldn't find any CSRF vulnerabilities. |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-server-header: Apache |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. |_sslv2-drown: MAC Address: 00:15:C5:F6:5D:94 (Dell) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 75.19 seconds
I was wondering if I had anything to worry about. I am also curious about the sslv2-drown in my Apache setup. I do use both http and https for my websites and have ports 80 & 443 accessible from WAN.
Any help would be appreciated.