Re: SSH Terrapin Prefix Truncation Weakness (CVE-2023-48795) on Red Hat Enterprise Linux release 8.7 (Ootpa)

A default RHEL 8/9 system is going to use the system-wide crypto=20
policies per /etc/sysconfig/sshd. Below is just a summarized version of=20
https://access.redhat.com/security/cve/cve-2023-48795

We can add in a cryptop-policies sub policy by creating the following file:

cat << EOF > /etc/crypto-policies/policies/modules/CVE-2023-48795.pmod
cipher@SSH =3D -CHACHA20-POLY1305
ssh_etm =3D 0
EOF

Append this crypto policy to your current system crypto policies:
update-crypto-policies --set $(update-crypto-policies --show):CVE-2023-4879=
5


Verify the new policy has taken place:
update-crypto-policies --show

Restart the application as recommended by command output:
systemctl restart sshd.service

Thanks,
Jacob

On 1/23/2024 11:02 AM, Kaushal Shriyan wrote:
> Hi,
>=20
> I have the SSH Terrapin Prefix Truncation Weakness on=C2=A0Red Hat Enterp=
rise=20
> Linux release 8.7 (Ootpa). The details are as follows.
>=20
> # rpm -qa | grep openssh
> openssh-8.0p1-16.el8.x86_64
> openssh-askpass-8.0p1-16.el8.x86_64
> openssh-server-8.0p1-16.el8.x86_64
> openssh-clients-8.0p1-16.el8.x86_64
>=20
> # cat /etc/redhat-release
> Red Hat Enterprise Linux release 8.7 (Ootpa)
> #
>=20
> SSH Terrapin Prefix Truncation Weakness (CVE-2023-48795)
>=20
> Synopsis
> The remote SSH server is vulnerable to a mitm prefix truncation attack.
> Description
> The remote SSH server is vulnerable to a man-in-the-middle prefix=20
> truncation weakness known as Terrapin.
> This can allow a remote, man-in-the-middle attacker to bypass integrity=
=20
> checks and downgrade the
> connection's security.
> Note that this plugin only checks for remote SSH servers that support=20
> either ChaCha20-Poly1305 or CBC
> with Encrypt-then-MAC and do not support the strict key exchange=20
> countermeasures. It does not check for
> vulnerable software versions.
> See Also
> https://terrapin-attack.com/ <https://terrapin-attack.com/>
>=20
> Solution
> Contact the vendor for an update with the strict key exchange=20
> countermeasures or disable the affected
> algorithms.
> Risk Factor
> Medium
> CVSS v3.0 Base Score
> 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
> CVSS v3.0 Temporal Score
> 5.3 (CVSS:3.0/E:P/RL:O/RC:C)
> VPR Score
> 6.9
> CVSS v2.0 Base Score
> 5.4 (CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:N)
> CVSS v2.0 Temporal Score
> 4.2 (CVSS2#E:POC/RL:OF/RC:C)
> 187315 (10) - SSH Terrapin Prefix Truncation Weakness (CVE-2023-48795) 16
>=20
> References
> CVE CVE-2023-48795
>=20
> Is there a way to configure /etc/ssh/sshd_config to mitigate SSH=20
> Terrapin Prefix Truncation Weakness (CVE-2023-48795)
>=20
> Please guide me.
>=20
> Thanks in advance.
>=20
> Best Regards,
>=20
> Kaushal
>=20
> --=20
> You received this message because you are subscribed to the Google=20
> Groups "[email protected]" group.
> To unsubscribe from this group and stop receiving emails from it, send=20
> an email to [email protected]=20
> <mailto:[email protected]>.

--=20
You received this message because you are subscribed to the Google Groups "=
[email protected]" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to [email protected].