Bug 1218208

Summary: VUL-0: CVE-2023-48795: terraform-provider-aws: golang.org/x/crypto/ssh: prefix truncation breaking ssh channel integrity
Product: [Novell Products] SUSE Security Incidents Reporter: Thomas Leroy <thomas.leroy>
Component: IncidentsAssignee: Robert Schweikert <rjschwei>
Status: NEW --- QA Contact: Security Team bot <security-team>
Severity: Critical    
Priority: P3 - Medium CC: andrea.mattiazzo, kvanderveer
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/387549/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-48795:5.9:(AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Bug Depends on:    
Bug Blocks: 1218150    

Comment 1 Thomas Leroy 2023-12-19 13:23:47 UTC
SUSE:SLE-15-SP2:Update/terraform-provider-aws uses a a vulnerable version of crypto/ssh package
Comment 2 Karen Van der Veer 2024-05-30 14:59:45 UTC
This bug wasn't showing in our search because the whiteboard field wasn't populated with the CVE- string. Could someone fill that in please?