social.coop

0 posts0 participants0 posts today

Kevin Karhan :verified:<a href="https://mastodon.parastor.net/@eroc1990" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@eroc1990</a> <a href="https://mastodon.green/@JohnDal" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@JohnDal</a> I disagree, as all such <a href="https://infosec.space/tags/SupplyChainAttacks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SupplyChainAttacks</a> are merely based upon lack or <a href="https://infosec.space/tags/reviewers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reviewers</a> and lack of <a href="https://infosec.space/tags/funding" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#funding</a>.<ul><li>Whereas with <a href="https://infosec.space/tags/CCSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CCSS</a> you have no independent auditability as with <a href="https://infosec.space/tags/FLOSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FLOSS</a> and everything is a "<a href="https://infosec.space/tags/TrustMeBro" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TrustMeBro</a>!" approach, which ALL the <a href="https://infosec.space/tags/GAFAMs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GAFAMs</a>, <a href="https://infosec.space/tags/PRISM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PRISM</a>-Collaborators, <a href="https://infosec.space/tags/CloudAct" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CloudAct</a> subjects and willingful <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Govware</a> integrators have forfeilt by their actions!</li></ul>Not to mention it's easier and faster to fix <a href="https://infosec.space/tags/FOSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FOSS</a> as well as the <a href="https://infosec.space/tags/diversity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#diversity</a> of systems mitigate said issues (i.e. <a href="https://infosec.space/tags/dropbear" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dropbear</a> was affected by neither <a href="https://infosec.space/tags/RegreSSHion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RegreSSHion</a> <a href="https://infosec.space/tags/XZ" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#XZ</a>'s <a href="https://infosec.space/tags/backdoor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#backdoor</a>, likely preventing another <a href="https://infosec.space/tags/Mirai" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mirai</a>-Style <a href="https://infosec.space/tags/Botnet" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Botnet</a> from being created...<ul><li>Instead of shoving money into buying <a href="https://infosec.space/tags/CSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CSS</a> Governments should instead provide proper fundibg to <a href="https://infosec.space/tags/OSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OSS</a>, instead of wasting it on <a href="https://infosec.space/tags/HypeBasedDevelopment" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HypeBasedDevelopment</a> / <a href="https://infosec.space/tags/BuzzwordDrivenDevelopment" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BuzzwordDrivenDevelopment</a> like <a href="https://infosec.space/tags/Zensursula" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Zensursula</a>'s <a href="https://ec.social-network.europa.eu/@EUCommission" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@EUCommission</a> does with garbage like "<a href="https://infosec.space/tags/AI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AI</a>"...</li></ul>After all, these issues are systemic, and denying the root cause is turning a blind eye at the obvious fix!

🦠Toxic Flange (Gurjeet)🔬⚱️🌚So I just read on <a href="https://defcon.social/@dcuthbert" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@dcuthbert@defcon.social</a> 's ( not that active on Masto - so <a href="https://bird.makeup/users/dcuthbert" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@dcuthbert@bird.makeup</a> for sauce) writeup on the <a href="https://infosec.exchange/tags/regresshion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#regresshion</a> <a href="https://infosec.exchange/tags/poc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#poc</a> backdoor ( <a href="https://bird.makeup/users/dcuthbert/statuses/1811327974513295432" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://bird.makeup/users/dcuthbert/statuses/1811327974513295432</a>)While they point out they would have used LKM to hide processes better, I just ran into something I didn't consider in hiding processes, <code>PID namespaces</code> ! Edit 1(disclaimer, I'm ignorant): This is a half baked thought process, and I haven't tested out this theory.. Might be a foot in mouth moment! This idea courtesy of <a href="https://infosec.exchange/tags/synology" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#synology</a> 's distro with their NAS (maybe their router software too).My Synology runs their "ContainerManager" package which is just docker. In the ContainerManager, I am running jellyfin and gitea.My usual experience in seeing what containers are running from a system defaults PoV from the shell I can run <code>ps auxw</code> or <code>ps -eLf</code> and I will expect to see the processes running from docker. I've attached a screenshot of docker in arch running jellyfin. There's also a screenshot of jellfyin running in Synology's 'locked down OS'. You can see its running, because <code>docker ps -a</code> tells us so.Heck from a system point of view, you can't even see docker/containerd running like you can from other Linux distros. Whats going on? Namespaces! Its not just for containers, available on enabled Linux kernels everywhere!Check out <a href="https://social.jvns.ca/@b0rk" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@b0rk</a> most excellent intro and writeup on it if you're not familiar. [<a href="https://jvns.ca/blog/2016/10/10/what-even-is-a-container/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://jvns.ca/blog/2016/10/10/what-even-is-a-container/</a>]Can you turn off namespaces on servers not meant to run containers? I believe you can restrict them with sysctl calls but I'm unsure of modern day distros for server use need them. So do you trust your vuln management sytems to help you know whats actually running on systems anymore? ;) Edit 2: if you want to see what Synology is doing and don't have a Synology device you can run their distro in a virtual machine. I don't know if you can really trust this or not, but I've used it in the past. Use at your own risk.The Redpill pre-install and Recovery environment. [<a href="https://github.com/RROrg/rr" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/RROrg/rr</a>]Synology DSM [<a href="https://archive.synology.com/download/Os/DSM" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://archive.synology.com/download/Os/DSM</a>]<a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/containers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#containers</a> <a href="https://infosec.exchange/tags/docker" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#docker</a> <a href="https://infosec.exchange/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linux</a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a>

gianarbI did a little exercise trying to figure out how my attempt to apply the <a href="https://hachyderm.io/tags/regresshion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#regresshion</a> to my <a href="https://hachyderm.io/tags/nixos" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nixos</a> servers <a href="https://shippingbytes.com/2024/07/09/timeline-to-patch-regresshion-to-my-public-servers/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://shippingbytes.com/2024/07/09/timeline-to-patch-regresshion-to-my-public-servers/</a>

ADMIN magazineResearchers at Qualys Threat Research Unit find critical OpenSSH vulnerability in glibc-based Linux systems <a href="https://www.admin-magazine.com/News/Critical-OpenSSH-Vulnerability-Affects-Linux-Systems" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.admin-magazine.com/News/Critical-OpenSSH-Vulnerability-Affects-Linux-Systems</a> <a href="https://hachyderm.io/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> <a href="https://hachyderm.io/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> <a href="https://hachyderm.io/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> <a href="https://hachyderm.io/tags/patch" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#patch</a> <a href="https://hachyderm.io/tags/regreSSHion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#regreSSHion</a>

AlmaLinuxLike with last week's <a href="https://fosstodon.org/tags/regreSSHion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#regreSSHion</a> patch, this week we are again patching OpenSSH ahead of our upstream to keep our users secure. <a href="https://almalinux.org/blog/2024-07-09-cve-2024-6409/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://almalinux.org/blog/2024-07-09-cve-2024-6409/</a> <a href="https://fosstodon.org/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linux</a> <a href="https://fosstodon.org/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a>

Simple NomadBlog post I did for work. Sorry it wasn't sooner, but nonetheless here it is, related to <a href="https://rigor-mortis.nmrc.org/tags/regresshion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#regresshion</a>. I guess had the impact been as great as all the headlines would have had you believe, it would have been done sooner.<a href="https://rigor-mortis.nmrc.org/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://rigor-mortis.nmrc.org/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://rigor-mortis.nmrc.org/tags/gitlab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gitlab</a> <a href="https://about.gitlab.com/blog/2024/07/09/faq-the-regresshion-vulnerability-and-gitlab/" rel="nofollow noopener noreferrer" target="_blank">https://about.gitlab.com/blog/2024/07/09/faq-the-regresshion-vulnerability-and-gitlab/</a>

Alex IvanovsRHEL 9 OpenSSH packages affected by remote code execution flaw<a href="https://stackdiary.com/rhel-9-openssh-packages-affected-by-remote-code-execution-flaw/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://stackdiary.com/rhel-9-openssh-packages-affected-by-remote-code-execution-flaw/</a><a href="https://mastodon.social/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> <a href="https://mastodon.social/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Vulnerability</a> <a href="https://mastodon.social/tags/RHEL9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RHEL9</a> <a href="https://mastodon.social/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://mastodon.social/tags/CVE20246409" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE20246409</a> <a href="https://mastodon.social/tags/RemoteCodeExecution" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RemoteCodeExecution</a> <a href="https://mastodon.social/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> <a href="https://mastodon.social/tags/Fedora" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fedora</a> <a href="https://mastodon.social/tags/RaceCondition" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RaceCondition</a> <a href="https://mastodon.social/tags/SIGALRM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SIGALRM</a> <a href="https://mastodon.social/tags/Exploit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Exploit</a> <a href="https://mastodon.social/tags/PatchManagement" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PatchManagement</a> <a href="https://mastodon.social/tags/Mitigation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mitigation</a> <a href="https://mastodon.social/tags/Infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Infosec</a> <a href="https://mastodon.social/tags/Threat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Threat</a> <a href="https://mastodon.social/tags/Hackers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hackers</a> <a href="https://mastodon.social/tags/Bug" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Bug</a> <a href="https://mastodon.social/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> <a href="https://mastodon.social/tags/Glitch" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Glitch</a> <a href="https://mastodon.social/tags/Audit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Audit</a> <a href="https://mastodon.social/tags/Syslog" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Syslog</a> <a href="https://mastodon.social/tags/Update" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Update</a> <a href="https://mastodon.social/tags/Enterprise" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Enterprise</a> <a href="https://mastodon.social/tags/LinuxSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LinuxSecurity</a> <a href="https://mastodon.social/tags/NetworkSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NetworkSecurity</a> <a href="https://mastodon.social/tags/ServerSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ServerSecurity</a> <a href="https://mastodon.social/tags/CyberThreat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberThreat</a> <a href="https://mastodon.social/tags/SystemAdmin" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SystemAdmin</a> <a href="https://mastodon.social/tags/TechNews" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TechNews</a> <a href="https://mastodon.social/tags/CVE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE</a> <a href="https://mastodon.social/tags/Mitre" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mitre</a> <a href="https://mastodon.social/tags/NIST" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NIST</a> <a href="https://mastodon.social/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a> <a href="https://mastodon.social/tags/DevOps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DevOps</a> <a href="https://mastodon.social/tags/regreSSHion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#regreSSHion</a>

Jan Wildeboer 😷:krulorange:Did a `dnf update` yesterday on my <a href="https://social.wildeboer.net/tags/RHEL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RHEL</a> 9 machines and now sshd is updated with the fix against <a href="https://social.wildeboer.net/tags/RegreSSHion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RegreSSHion</a>.

Edoardo DusiEccoci qua con una nuova puntata da quasi mezz'ora e con tanti spiegoni su due incidenti di cybersecurity che secondo me meritavano approfondimenti e quindi ho pensato che pure voi meritaste il puntatone drammatico. Quindi se volete qui vi beccate due cose, una vulnerabilità trovata in OpenSSH e chiamata regreSSHion e un attacco alla supply chain JavaScript sfruttando la CDN di Polyfill.io.<a href="https://continuousdelivery.social/tags/regresshion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#regresshion</a> <a href="https://continuousdelivery.social/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://continuousdelivery.social/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a> <a href="https://continuousdelivery.social/tags/polyfill" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#polyfill</a> <a href="https://continuousdelivery.social/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#javascript</a> <a href="https://youtu.be/HlFYAA9hAeg" rel="nofollow noopener noreferrer" target="_blank">https://youtu.be/HlFYAA9hAeg</a>

NicdIronically after publishing the <a href="https://social.ahlcode.fi/tags/regreSSHion" rel="nofollow noopener noreferrer" target="_blank">#regreSSHion</a> vulnerability, it seems <a href="https://social.ahlcode.fi/tags/Qualys" rel="nofollow noopener noreferrer" target="_blank">#Qualys</a>'s own blog was compromised for a short while: <a href="https://borncity.com/win/2024/07/03/has-the-qualys-blog-been-hacked-july-2-2024/" rel="nofollow noopener noreferrer" target="_blank">https://borncity.com/win/2024/07/03/has-the-qualys-blog-been-hacked-july-2-2024/</a>

Elis H 🌱<a href="https://graz.social/@publicvoit" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@publicvoit</a> Uh, yes? They have. <a href="https://nixpk.gs/pr-tracker.html?pr=323753" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://nixpk.gs/pr-tracker.html?pr=323753</a><a href="https://chaos.social/tags/nixos" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nixos</a> <a href="https://chaos.social/tags/regresshion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#regresshion</a> <a href="https://chaos.social/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a>

Karl Voit :emacs: :orgmode:Not even <a href="https://graz.social/tags/NixOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NixOS</a> has a patched <a href="https://graz.social/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> version to mitigate <a href="https://graz.social/tags/regreSSHion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#regreSSHion</a> yet. 😔 OK, at least disabling sshd is very easy.Edit/Correction: NixOS somehow decided not to change the version number for a patched OpenSSH version. So you can have 9.7p1 with the vulnerability and 9.7p1 without. 🤷 🤦‍♂️ <a href="https://github.com/NixOS/nixpkgs/pull/323761/files" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/NixOS/nixpkgs/pull/323761/files</a>So the usual "am I vulnerable?"-instructions to the CVE are useless with NixOS.

Flatcar Container Linux 🚂New Flatcar releases for all channels now available! 📦 Package update: OpenSSH 🔒 CVE fix: OpenSSH (CVE-2024-6387) (<a href="https://hachyderm.io/tags/regreSSHion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#regreSSHion</a>) 📜 Release notes at the usual spot: <a href="https://www.flatcar.org/releases/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.flatcar.org/releases/</a>

uniqWe patched <a href="https://chaos.social/tags/regresshion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#regresshion</a> at <a href="https://chaos.social/tags/FDroid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FDroid</a> yesterday. Hell of a backdoor, really makes one wonder what else is out there. 😓 <a href="https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server</a>

PrivacyDigest“RegreSSHion” <a href="https://mas.to/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> in <a href="https://mas.to/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> gives attackers root on <a href="https://mas.to/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> <a href="https://mas.to/tags/RegreSSHion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RegreSSHion</a><a href="https://arstechnica.com/?p=2035011" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://arstechnica.com/?p=2035011</a>

Víctor A. Rodríguez :verified:<a href="https://mastodon.social/@arstechnica" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@arstechnica</a> Some scripting to detect vulnerable <a href="https://techhub.social/tags/regreSSHion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#regreSSHion</a> <a href="https://techhub.social/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> version and patch sshd config by LoginGraceTimesed -i 's/.*LoginGraceTime.*/LoginGraceTime 0/' /etc/ssh/sshd_config <a href="https://gitlab.com/bit-man/os-mindset/-/raw/master/lib/debian/regreSSHion?ref_type=heads" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://gitlab.com/bit-man/os-mindset/-/raw/master/lib/debian/regreSSHion?ref_type=heads</a>

Royce WilliamsQuestion about the OpenSSH vuln: Do all the attempts have to come from a single connection?Or could attack be distributed across a fleet of source IPs (impacting effectiveness of fail2ban, etc.)<a href="https://infosec.exchange/tags/RegreSSHion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RegreSSHion</a> <a href="https://infosec.exchange/tags/OpenSSH" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSH</a> <a href="https://infosec.exchange/tags/cve_2024_6387" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cve_2024_6387</a>

Larvitz :fedora: :redhat:There isn't yet a patch for CVE-2024-6387 a.k.a. "regreSSHion" in RHEL9 but Red Hat suggests a mitigation by setting LoginGraceTime to 0 in sshd_config (source: <a href="https://access.redhat.com/security/cve/cve-2024-6387" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://access.redhat.com/security/cve/cve-2024-6387</a>)I wrote a small Ansible playbook to do this on multiple systems in an automated way.If someone has the same task, feel free to draw inspiration from here:<a href="https://gist.github.com/chofstede/67641b45f7b2379bab5832b70c0b8351" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://gist.github.com/chofstede/67641b45f7b2379bab5832b70c0b8351</a>It's tested and idempotent (can run multiple times with the same result) but no warranties. Use at your own risk.And for other systems, I've made a playbook to patch openssh to the latest version: <a href="https://gist.github.com/chofstede/c076ededc4fbf0478740473542af98c3" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://gist.github.com/chofstede/c076ededc4fbf0478740473542af98c3</a>)<a href="https://burningboard.net/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linux</a> <a href="https://burningboard.net/tags/regresshion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#regresshion</a> <a href="https://burningboard.net/tags/cve20246387" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cve20246387</a> <a href="https://burningboard.net/tags/ansible" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ansible</a> <a href="https://burningboard.net/tags/rhel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rhel</a> <a href="https://burningboard.net/tags/redhat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#redhat</a> <a href="https://burningboard.net/tags/mitigation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mitigation</a> <a href="https://burningboard.net/tags/sysadmin" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sysadmin</a> <a href="https://burningboard.net/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a> <a href="https://burningboard.net/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a>

Genmaune faille critique dans <a href="https://framapiaf.org/tags/openssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openssh</a> appelée <a href="https://framapiaf.org/tags/regreSSHion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#regreSSHion</a> Moi quand je vais mettre mes serveurs à jour pour patcher... Qui a la référence ?

Adi'Vaala vas Miðgarðr 👨🏼‍💻<a href="https://swiss.social/tags/regreSSHion" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#regreSSHion</a> 🙃

Recent searches

Search options

Administered by:

Server stats:

#regresshion