Re: openSSH Vulnerability

2019-03-20 Thread Brian Inglis
On 2019-03-20 09:06, Bill Stewart wrote: > On Wed, Mar 20, 2019 at 8:53 AM Bruce Halco wrote: >> The problem is I have 8 customers failing PCI network scans because of >> CVE-2019-6111, so I don't think the patch for CVE-2018-20685 is going to >> help. >> If 8.0 is close (maybe weeks?) I can afford

Re: openSSH Vulnerability

2019-03-20 Thread Bill Stewart
On Wed, Mar 20, 2019 at 8:53 AM Bruce Halco wrote: > The problem is I have 8 customers failing PCI network scans because of > CVE-2019-6111, so I don't think the patch for CVE-2018-20685 is going to > help. > > If 8.0 is close (maybe weeks?) I can afford to wait a while. Otherwise > I'll have to t

Re: openSSH Vulnerability

2019-03-20 Thread Bruce Halco
The problem is I have 8 customers failing PCI network scans because of CVE-2019-6111, so I don't think the patch for CVE-2018-20685 is going to help. If 8.0 is close (maybe weeks?) I can afford to wait a while. Otherwise I'll have to take some other action. I don't like any of my alternatives

Re: openSSH Vulnerability

2019-03-20 Thread Corinna Vinschen
On Mar 20 09:13, Bruce Halco wrote: > openSSH 7.9 is subject to vulnerability CVE-2019-6111. This has been fixed > in at least some distributions, Debian at least. Fedora (which is our role model) doesn't and the vulnerability is not deemed that critical by the upstream maintainers: https://lists