1

I’m running a site on Google Cloud Computing, which uses debian distrib. We recently had a security audit, and one recommendation was to upgrade to OpenSSH from 7.4 to 7.8 or later. apt is showing

openssh-server/oldstable,now 1:7.4p1-10+deb9u6 amd64 [installed,upgradable to: 1:7.4p1-10+deb9u7]

Looks like the best we could do with an upgrade via apt would be to a slightly newer version of 7.4. Is there a way to force it to 7.8, or would that take a new kernel? I could pull down the source, compile and install it, but would that break other things on the system? This is a production site, so I don't want any surprises.

Improve this question
4
  • 2
    Always install the the latest version (security fix) from the official debian repository; there is no need for upgrading to new version. The security fixes are always backported in debian-security.
    – Ipor Sircer
    Aug 5, 2020 at 22:08
  • You can check the debian security tracker: security-tracker.debian.org/tracker/source-package/openssh to know what's patched or not for a given version (seems there's still some work to do, but not all CVE are equal, most remaining are written as "unimportant")
    – A.B
    Aug 5, 2020 at 23:38
  • Thanks for the info. Ipor, this is the vulnerability identified in the automated security scan: security-tracker.debian.org/tracker/CVE-2018-15473 - are you saying it could be patched or updated to 7.4p1-10+deb9u6 and the issue would be fixed? Would an automated scan then be able to tell it was fixed, without having to go to 7.8?
    – pglatz
    Aug 6, 2020 at 0:04
  • The link tells it was patched in 1:7.4p1-10+deb9u4 : it's already patched even without the last upgrade (that you should do anyway).
    – A.B
    Aug 6, 2020 at 6:27

1 Answer 1

Reset to default
3

In general, you should use the latest version for the stable Debian version you're running. That version will have all the security fixes applied, and in this case, CVE-2018-15473 is fixed by the upgrade to the latest version in stretch and buster.

Security vulnerability scanners often flag false positives because most Linux distros backport security fixes to the latest stable version instead of updating the package to the latest version. Often the latest version can have breaking changes or incompatible behavior, and users would not appreciate an automatic update to their stable version breaking things.

Most of the time, these versions don't contain a distinguishing version number that's exposed to external systems. Reporting version numbers is generally frowned upon from a security perspective, because it leaks information. So if the security audit reports an issue, you should ask what vulnerabilities they've identified, and be prepared to show that you're running a patched version that addresses them. The companies that run these security audits tell you to upgrade because that's the easiest thing and finding problems with secure but older software makes people think their services are valuable, but major companies just use the patched distro packages in practice.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .