Clarity on fix for CVE-2024-6387 CVE-2024-39894 on 24.04.2 LTS

Support and Help
,
1

HI all,
First time post.
Trying to resolve this so as not to show on vulnerability scanner as being open.
Server has been flagged by an interested third party with above two CVEs relating to OpenSSH.
CVE-2024-6387 OpenSSH SSHD Security Regression CVE-2024-39894. Information I have indicates it was patched in July 2024. I read that this fix may have been undone by a subsequent patch. Machine is currently patched to current updates. Only way to move past OpenSSH_9.6p1 is to download a tgz and create another service. Then I will break the patching mechanism. Any thoughts gratefully received.

1 Like
2

Welcome. Let’s see if we can get this sorted.

Hmmm


  1. How did you determine that your scanner is not showing a false positive?

    Or are you asking us to refute the positive result?
    (If so, see CVE-2024-6387 | Ubuntu and https://ubuntu.com/security/CVE-2024-39894 )

    If your scanner is showing a positive result after installing the patched package, that’s usually a false positive. False positives are most commonly a scanner issue, and cannot be fixed by Ubuntu. They must be fixed by the scanner vendor.

  2. Let’s double-check that.
    Please show us the complete output of
    apt list openssh-client openssh-server

  3. I’m assuming you have read https://ubuntu.com/security/cves/about#security
    Particularly (emphasis ours)


    Update manually

    You can also get patches as soon as they become available by upgrading all your installed packages to the latest version. You can do this by running the following command in your terminal:

    sudo apt update && sudo apt upgrade

    We recommend not to cherry-pick updates from individual packages. If no fix is available yet for a specific CVE, you can check if there is any mitigation or further information in the notes of the CVE page.

1 Like
3

Thank you for your reply. I will digest this.
Here is the easiest reply, first.
“root@localhost:~# apt list openssh-client openssh-server
Listing
 Done
openssh-client/noble-updates,noble-security,now 1:9.6p1-3ubuntu13.11 amd64 [installed,automatic]
openssh-server/noble-updates,noble-security,now 1:9.6p1-3ubuntu13.11 amd64 [installed]”

4

Okay, let’s take these one at a time.

CVE-2024-39894 | Ubuntu :
image
Your installed version is 1:9.6p1-3ubuntu13.11 which is higher (newer) than 1:9.6p1-3ubuntu13.4, which means you have that patch already.
if your scanner says it’s vulnerable, that looks like a false positive.

https://ubuntu.com/security/CVE-2024-6387 :
image
Your installed version is 1:9.6p1-3ubuntu13.11 which is higher (newer) than 1:9.6p1-3ubuntu13.3, which again means you have that patch already.
if your scanner says it’s vulnerable, that looks like another false positive.

It’s occasionally possible that there might be something unusual going on that requires further investigation, but that’s very rare, and would usually be mentioned on the linked CVE pages.

For something widely installed like an ssh server, that kind of “something unusual” (like a CVE marked ‘fix’ that actually isn’t fixed) would show up in the trade press. A lot of people would care about that. I haven’t seen anything like that in the press recently.

False positives from scanners, though, are very common. Again, false positives cannot be ‘fixed’ by Ubuntu (it’s not vulnerable! It’s fixed!) – those are issues with the scanner.

Does that help?

1 Like
5

Thank you @ian-weisser sir!

That does gives me a more confidence. It was flagged by our insurer. We are now aware that this demonstrates that at least two different commercial vulnerability scanners are showing a false positive.

1 Like
6

Try using an OVAL compliant scanner:

4 Likes