openssh-client encounters MAC algo issue with EL8

[Vip]

Ubuntu 22.04 system connecting to an Oracle Linux v8 host. The following error occurs regardless of the the MACs specified (or not) in sshd_config:

Corrupted MAC on input.
ssh_dispatch_run_fatal: Connection to XX.XX.XX.XX port 22: message authentication code incorrect

Presumably, this may happen on any RHEL v8 variant. Note that connecting to Enterprise Linux v7 work as well as other Ubuntu hosts. Downgrading to previous version of openssh-client fixes issue.

apt install openssh-client=1:8.9p1-3

[Marc Deslauriers (mdeslaur)]

Hi,

Thanks for reporting this issue. I can't seem to reproduce it though with Oracle Linux v8 running openssh-server-8.0p1-17.el8.x86_64 and an Ubuntu 22.04 client running 1:8.9p1-3ubuntu0.6.

Could you perhaps give me a bit more details on how I could reproduce this?

Thanks!

[IBAUTO (ibauto)]

We are having the same with OL8 8.9
Openssh used om OL8 = 8.0p1-19.el8_9.2

Ubuntu 18.04, 20.04 and 22.04 who update to are having a problem

We downgraded our versions temporary to

18.04: openssh-server=1:7.6p1-4ubuntu0.7
20.04: openssh-server=1:8.2p1-4
22.04: openssh-server=1:8.9p1-3

[Marc Deslauriers (mdeslaur)]

The Oracle Linux I'm running is the v8 developer preview, as that is the only freely downloadable version.

I couldn't reproduce the issue with openssh-server-8.0p1-17.el8.x86_64.

Since I can't get newer packages from Oracle with this version, I installed openssh, openssh-askpass, openssh-client and openssh-server 8.0p1-19.el8_9.2 from RockyLinux into the Oracle install, and I still can't reproduce the issue.

Could someone perhaps email me the 4 Oracle binary rpms for the packages listed above so I can try them?

[Marc Deslauriers (mdeslaur)]

OK, I have managed to locate the Oracle binary packages for 8.0p1-19.el8_9.2 and can confirm the issue. This is curious as the same packages from RockyLinux appear to work. I will attempt to investigate the differences.

[Marc Deslauriers (mdeslaur)]

I believe this issue is caused by a bad backport in Oracle's 8.0p1-19.el8_9.2 package. I think their fix for CVE-2023-48795 isn't properly adding <email address hidden> to their KEX. Downgrading the Ubuntu package works around the problem as that prevents the client from offering <email address hidden>.

[Vip (vipool)]

Thank you Marc and ibauto. I'll try to investigate/report on the Oracle Linux 8 side.

[Marc Deslauriers (mdeslaur)]

I am closing this bug since the issue appears to be in Oracle Linux and is being tracked here:

https://github.com/oracle/oracle-linux/issues/125

Thanks!