{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "OpenSSH ist eine Open Source Implementierung des Secure Shell Protokolls.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenSSH ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-0068 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2023-0068.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-0068 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0068"
      },
      {
        "category": "external",
        "summary": "NIST Database vom 2020-06-29",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14145"
      },
      {
        "category": "external",
        "summary": "F5 Security Advisory K48050136 vom 2020-10-13",
        "url": "https://support.f5.com/csp/article/K48050136"
      },
      {
        "category": "external",
        "summary": "Mailing list OSS-Security vom 2020-12-01",
        "url": "https://www.openwall.com/lists/oss-security/2020/12/02/1"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2020:3736-1 vom 2020-12-10",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2020-December/007952.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2020:3844-1 vom 2020-12-16",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2020-December/008074.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2020:3866-1 vom 2020-12-17",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2020-December/008083.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2020:3882-1 vom 2020-12-18",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2020-December/008089.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2021:0022-1 vom 2021-01-05",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-January/008149.html"
      },
      {
        "category": "external",
        "summary": "Gentoo Linux Security Advisory GLSA-202105-35 vom 2021-05-26",
        "url": "https://security.gentoo.org/glsa/202105-35"
      },
      {
        "category": "external",
        "summary": "EMC Security Advisory DSA-2021-114 vom 2021-06-01",
        "url": "https://www.dell.com/support/kbdoc/de-de/000187723/dsa-2021-114-dell-emc-networker-vproxy-security-update-for-multiple-third-party-component-vulnerabilities"
      },
      {
        "category": "external",
        "summary": "IGEL Security Notice ISN-2021-06 vom 2021-08-02",
        "url": "https://kb.igel.com/securitysafety/en/isn-2021-06-igel-os-openssh-vulnerabilities-47717622.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2021:4368 vom 2021-11-09",
        "url": "https://access.redhat.com/errata/RHSA-2021:4368"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2021-4368 vom 2021-11-16",
        "url": "https://linux.oracle.com/errata/ELSA-2021-4368.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2021:4848 vom 2021-11-29",
        "url": "https://access.redhat.com/errata/RHSA-2021:4848"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA70182 vom 2023-01-12",
        "url": "https://supportportal.juniper.net/s/article/2023-01-Security-Bulletin-Contrail-Service-Orchestration-Multiple-vulnerabilities-resolved-in-CSO-6-3-0?language=en_US"
      },
      {
        "category": "external",
        "summary": "HPE Securi+y Bulletin",
        "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-hpesbst04494en_us"
      },
      {
        "category": "external",
        "summary": "ExtremeNetworks Vulnerability Notice SA-2023-091 vom 2023-08-30",
        "url": "https://extremeportal.force.com/ExtrArticleDetail?an=000113692"
      },
      {
        "category": "external",
        "summary": "SEM 2024.2 release notes vom 2024-04-17",
        "url": "https://documentation.solarwinds.com/en/success_center/sem/content/release_notes/sem_2024-2_release_notes.htm"
      },
      {
        "category": "external",
        "summary": "### vom 2024-04-17",
        "url": "https://documentation.solarwinds.com/en/success_center/sem/content/release_notes/sem_2024-2_release_notes.htm"
      }
    ],
    "source_lang": "en-US",
    "title": "OpenSSH: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen",
    "tracking": {
      "current_release_date": "2024-04-16T22:00:00.000+00:00",
      "generator": {
        "date": "2024-04-17T08:07:27.013+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2023-0068",
      "initial_release_date": "2020-06-29T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2020-06-29T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2020-10-13T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von F5 aufgenommen"
        },
        {
          "date": "2020-10-14T22:00:00.000+00:00",
          "number": "3",
          "summary": "Gegenma\u00dfnahmen angepasst"
        },
        {
          "date": "2020-12-01T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von OpenSSH"
        },
        {
          "date": "2020-12-09T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2020-12-16T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2020-12-17T23:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2020-12-20T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2021-01-05T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2021-05-25T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Gentoo aufgenommen"
        },
        {
          "date": "2021-06-01T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von EMC aufgenommen"
        },
        {
          "date": "2021-08-02T22:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von IGEL aufgenommen"
        },
        {
          "date": "2021-11-09T23:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2021-11-16T23:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2021-11-29T23:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-01-11T23:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Juniper aufgenommen"
        },
        {
          "date": "2023-08-13T22:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von HP aufgenommen"
        },
        {
          "date": "2023-08-30T22:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von ExtremeNetworks aufgenommen"
        },
        {
          "date": "2024-04-16T22:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates aufgenommen"
        }
      ],
      "status": "final",
      "version": "19"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Broadcom Brocade Switch",
            "product": {
              "name": "Broadcom Brocade Switch",
              "product_id": "T015844",
              "product_identification_helper": {
                "cpe": "cpe:/h:brocade:switch:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Broadcom"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c19.4.0.2",
                "product": {
                  "name": "EMC NetWorker \u003c19.4.0.2",
                  "product_id": "T019366",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:emc:networker:19.4.0.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "NetWorker"
          }
        ],
        "category": "vendor",
        "name": "EMC"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Extreme Networks ExtremeXOS",
            "product": {
              "name": "Extreme Networks ExtremeXOS",
              "product_id": "T020452",
              "product_identification_helper": {
                "cpe": "cpe:/o:extremenetworks:extremexos:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Extreme Networks"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "F5 BIG-IP",
            "product": {
              "name": "F5 BIG-IP",
              "product_id": "T001663",
              "product_identification_helper": {
                "cpe": "cpe:/a:f5:big-ip:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "F5"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Gentoo Linux",
            "product": {
              "name": "Gentoo Linux",
              "product_id": "T012167",
              "product_identification_helper": {
                "cpe": "cpe:/o:gentoo:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Gentoo"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "HPE Switch",
            "product": {
              "name": "HPE Switch",
              "product_id": "T005119",
              "product_identification_helper": {
                "cpe": "cpe:/h:hp:switch:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "HPE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IGEL OS",
            "product": {
              "name": "IGEL OS",
              "product_id": "T017865",
              "product_identification_helper": {
                "cpe": "cpe:/o:igel:os:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "IGEL"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Juniper Contrail Service Orchestration",
            "product": {
              "name": "Juniper Contrail Service Orchestration",
              "product_id": "T025794",
              "product_identification_helper": {
                "cpe": "cpe:/a:juniper:contrail_service_orchestration:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Juniper"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=8.3",
                "product": {
                  "name": "Open Source OpenSSH \u003c=8.3",
                  "product_id": "T017823",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openbsd:openssh:8.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.4",
                "product": {
                  "name": "Open Source OpenSSH \u003c8.4",
                  "product_id": "T017824",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:openbsd:openssh:8.4"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenSSH"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2024.2",
                "product": {
                  "name": "SolarWinds Security Event Manager \u003c2024.2",
                  "product_id": "T034244",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:solarwinds:security_event_manager:2024.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Security Event Manager"
          }
        ],
        "category": "vendor",
        "name": "SolarWinds"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-14145",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in OpenSSH. Diese besteht aufgrund eines Fehlers bei der Aushandlung des Algorithmus. Ein Angreifer in einer Man in the Middle Position kann diese Schwachstelle ausnutzen, um die Kryptografie zu umgehen und somit Daten mitzulesen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T002207",
          "67646",
          "T017865",
          "T015844",
          "T001663",
          "T005119",
          "T012167",
          "T004914",
          "T020452",
          "T025794",
          "T034244"
        ],
        "last_affected": [
          "T017823"
        ]
      },
      "release_date": "2020-06-29T22:00:00Z",
      "title": "CVE-2020-14145"
    }
  ]
}