我想升级我的 openssh 版本以解决CVE-2024-6387问题,运行后apt update
我apt upgrade
看到以下输出:
❯ sudo apt upgrade openssh-client
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
openssh-client is already the newest version (1:8.9p1-3ubuntu0.10).
openssh-client set to manually installed.
Calculating upgrade... Done
#
# OpenSSH CVE-2024-6387 has been fixed for 22.04 LTS, 23.10 and 24.04 LTS.
# RegreSSHion: Possible RCE Due To A Race Condition In Signal Handling.
# For more details see: https://ubuntu.com/security/notices/USN-6859-1.
#
The following packages have been kept back:
python3-update-manager update-manager update-manager-core
0 upgraded, 0 newly installed, 0 to remove and 3 not upgraded.
❯ sudo apt upgrade openssh-server
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
openssh-server is already the newest version (1:8.9p1-3ubuntu0.10).
Calculating upgrade... Done
#
# OpenSSH CVE-2024-6387 has been fixed for 22.04 LTS, 23.10 and 24.04 LTS.
# RegreSSHion: Possible RCE Due To A Race Condition In Signal Handling.
# For more details see: https://ubuntu.com/security/notices/USN-6859-1.
#
The following packages have been kept back:
python3-update-manager update-manager update-manager-core
0 upgraded, 0 newly installed, 0 to remove and 3 not upgraded.
❯ ssh -V
OpenSSH_8.9p1 Ubuntu-3ubuntu0.10, OpenSSL 3.0.2 15 Mar 2022
因此,我的 openssh-client 和 openssh-server 都使用修补版本 8.9p1-3,但运行时ssh -V
我看到的是 8.9p1,这似乎是未修补的版本。这是预期的行为吗?ssh -V
还是它以某种方式指向了错误的版本?如果是这样,我该如何修复?
Jammy 22.04的
-3ubuntu0.10
是软件包修订版本字符串,而不是 OpenSSH 本身的版本字符串(即8.9p1
)。系统上的 OpenSSH 基本版本(不包括以此方式包含的软件包修订和补丁)是 8.9p1。默认情况下,OpenSSH 的-V
(version) 调用将仅声明基本OpenSSH 版本,而不是 Ubuntu 软件包修订数据。您仍然已修补,但由于软件的编译方式,您不会在 OpenSSH 的版本输出中看到更新的版本字符串,这是预期的行为。
请注意,您实际上必须检查已安装的软件包修订版、其补丁集和安全声明,以确定包含或未包含的内容。不过,只要安装的软件包版本等于或高于以下版本(来自Ubuntu CVE 跟踪器中的 CVE-2024-6487),您就已修补了 CVE-2024-6387(又名 RegreSSHion):
1:8.9p1-3ubuntu0.10
1:9.3p1-1ubuntu3.6
1:9.6p1-3ubuntu13.3
早于此版本的 OpenSSH 基础版本
8.5p1
不受影响。