0

I'm trying to update the Ubuntu OpenSSH version to 9.3p2, because of the CVE-2023-38408 vulnerability, but I can't.

The recomendation is update to last version: https://ubuntu.com/security/CVE-2023-38408

I am running the following command: https://ubuntu.com/security/CVE-2023-38408

What can I do?

2
  • There is an established software update process on Ubuntu, which includes all software on the system including OpenSSH. Use it. Note that it is common for distributions like Ubuntu or RHEL to backport patches into the version they've shipped with the system instead of always upgrading to the newest software version. Thus don't just look at the software version when checking if the problem was addressed Aug 14, 2023 at 5:03
  • "But I can't" -- can't what? What command? There's no command in that link. And how is this a security question? I'd migrate this to SuperUser, but you're missing some relevant details.
    – schroeder
    Aug 14, 2023 at 8:10

2 Answers 2

2

Please read the status section of the page you have linked!

The CVE-2023-38408 is addressed (backported), e.g.,

Package Release Status
openssh focal Released (1:8.2p1-4ubuntu0.8)
openssh jammy Released (1:8.9p1-3ubuntu0.3)
openssh lunar Released (1:9.0p1-1ubuntu8.4)

You can use dpkg -l "openssh*" to confirm you have this version (or above) installed.

0

Most Unix or Unix-like systems like Linux use a number of inter-dependant open source tools as internal tools. For that reason, they also use a concept of distribution: a core system (for Linux it is mainly the kernel) and a number of additional tools. And all that distribution is maintained as a whole.

That means that as soon as you use a tool installed from the distrib, you should not try to change its version: just look in the distribution (here Ubuntu) to see whether a security problem is addressed and just upgrade the tool inside the distrib or at most upgrade the whole distribution is you are using a no longer supported distribution.

The alternative when you want to use a feature that is not yet present in the version provided by your distribution, or is the tool is no longer maintained by that distrib, is to install a new version of the software outside of the base distribution. You could by example install it in the /usr/local folders and manually alter the config files to use it. Because of the automatic dependances of the distributions, it is often simpler to leave the distribution version exist side by side with the local one. But this has 2 major drawbacks:

  1. you now have two concurrent installations of the same tool and are responsible to know which on is used and where
  2. you are now responsible for caring for security updates for the piece of software that you have installed outside of the distrib.

Because of that, this kind of installation is seldom used on Unix, and only exceptionally on a distribution like Ubuntu which is targetted at end users. I once used it on a small FreeBSD system to be able to use the last features of an Apache httpd server, but I had to follow 2 separate maintenance processes until the Apache version I wanted was included in the FreeBSD line that I used: one for the Apache software and one for the FreedBSD system. Not the kind of thing a system admin is glad to do, because you now do the same job twice...

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .