0

Dear Ubuntu Community,

I have a question regarding CVE-2021-41617 , On https://ubuntu.com/security/CVE-2021-41617 I can see that a fix for Ubuntu Jammy is needed , but in the changelog https://launchpad.net/ubuntu/jammy/+source/openssh/+changelog I can see that CVE-2021-41617 is fixed. Also the security scanners found Ubuntu Jammy vulnerable to the mentioned CVE. Do anyone know why it is still reported for Jammy am I missing something?

Thanks in advance

Improve this question
2
  • 1
    It seems someone forgot to update the Ubuntu security site, as it seems fixed. I'd trust the changenotes more than the CVE site in this case.
    – Artur Meinild
    May 31 at 11:37
  • 1
    "security scanners" are notoriously ill-informed and prone to false results. Their output should be considered a first draft for human review.
    – user535733
    May 31 at 12:20

1 Answer 1

Reset to default
2

The available evidence leads to the conclusion that the CVE mitigation patch was indeed applied in 2021, and that the discrepancy has a reasonable explanation.

The patch was seemingly applied at Debian, not by the Ubuntu Security Team. The reference bug number "(closes: #995130)" is a Debian bug reference, not a Launchpad bug.

Nothing wrong there -- that's a reasonable place to do the patching, and the patching was done by a developer with plenty of experience with that code and a great reputation at both Debian and Ubuntu. But it does perhaps explain why the Ubuntu tracker didn't notice.

I have pinged the Ubuntu Security Team to review and decide if any change to their tracker is needed.

Improve this answer
2
  • thank you very much for the quick resolution. I'd like to ask about this one ubuntu.com/security/CVE-2020-14145 , here only versions of openssh up to 8.6 are mentioned. In Jammy we have openssh 8.9 do this mean that it is not vulnerable to the mentioned CVE ?
    – Dimitar Kapashikov
    May 31 at 13:08
  • Please open new Questions for separate issues. Be sure to read the engineer comments, which usually explain the issue (and resolution) better than the volunteers here can.
    – user535733
    May 31 at 13:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .