The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-contro...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Debian:12 openssh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p1-1"}]}]

Debian:13 openssh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p1-1"}]}]

Debian:14 openssh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p1-1"}]}]

参照URL

advisory security-tracker.debian.org