OpenSSH User Enumeration Vulnerability (CVE-2018-15473) Vulnerability Fix

1 Vulnerability description

2 Bug fixes

Check the current openssh version:

[root@izr0a05u4qferpr7yfhtotz ~]# ssh -V
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
[root@izr0a05u4qferpr7yfhtotz ~]#

Download the openssh 7.8 version installation package and upload it to the server;

Unzip the installation package:

[root@izr0a05u4qferpr7yfhtoqz opt]# tar -xvf openssh-7.8p1.tar.gz

Enter the decompressed directory and start compilation and installation:

[root@izr0a05u4qferpr7yfhtoqz opt]# cd openssh-7.8p1
[root@izr0a05u4qferpr7yfhtoqz openssh-7.8p1]# ./configure
...省略过程日志...
[root@izr0a05u4qferpr7yfhtoqz openssh-7.8p1]# make
...略过程日志...
[root@izr0a05u4qferpr7yfhtoqz openssh-7.8p1]# make install

3 related questions

• If the following error occurs during compilation, it means that zlib is not installed:

checking for zlib.h... no
configure: error: *** zlib.h missing - please install first or check config.log ***

Install zlib:

yum -y install zlib zlib-devel

• If the following error occurs during compilation:

checking for openssl/opensslv.h... no
configure: error: *** OpenSSL headers missing - please install first or check config.log ***

Solution:

yum install openssl openssl-devel