Include mitigation for CVE-2020-14145

[Marc Deslauriers]

While there is no actual fix for CVE-2020-14145, as the upstream OpenSSH developers have stated that there are no plans to change the behaviour of OpenSSH to fix the issue, there does exist a commit that does mitigate the issue in certain scenarios.

When the client has a host key that happens to match the first entry in the preferred algorithms list, the mitigation will have the client send the default algorithm ordering to the server.

See:

https://www.openwall.com/lists/oss-security/2020/12/02/1
https://anongit.mindrot.org/openssh.git/commit/?id=b3855ff053f5078ec3d3c653cdaedefaa5fc362d

This was included in Ubuntu 22.04 LTS and higher, but has not been included in 22.04 LTS and previous versions.

We should release an update with this mitigation included.

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssh - 1:8.2p1-4ubuntu0.9

---------------
openssh (1:8.2p1-4ubuntu0.9) focal-security; urgency=medium

  * SECURITY UPDATE: information leak in algorithm negotiation (LP: #2030275)
    - debian/patches/CVE-2020-14145-mitigation.patch: tweak the client
      hostkey preference ordering algorithm in sshconnect2.c.
    - Note: This update does not solve CVE-2020-14145, but does mitigate
      the issue in the specific scenario where the user has a key that
      matches the best-preference default algorithm.

 -- Marc Deslauriers <email address hidden> Fri, 04 Aug 2023 18:02:08 -0400

[Nishit Majithia (0xnishit)]

The package has been updated with the mitigation
https://ubuntu.com/security/notices/USN-6279-1