Package: gnome-control-center
Version: 1:45.1-1
Severity: important
Tags: upstream security
Forwarded: https://gitlab.gnome.org/GNOME/gnome-control-center/-/issues/2794
X-Debbugs-Cc: team@security.debian.org
Control: found -1 1:3.30.3-2~deb10u1
Control: found -1 1:3.38.4-1
Control: found -1 1:43.6-2~deb12u1

If ssh.service is disabled but ssh.socket is enabled, as documented
in file:///usr/share/doc/openssh-client/README.Debian.gz section
"Socket-based activation with systemd", then gnome-control-center's
Sharing panel will indicate that remote login via ssh is
disabled. This was originally reported to Ubuntu by Zygmunt Krynicki in
https://bugs.launchpad.net/ubuntu/+source/gnome-control-center/+bug/2039577.

Ubuntu have treated this as a security issue, on the basis that users
who have been misinformed about the status of remote login might make
security-sensitive assumptions that are, in fact, untrue. I'm not really
convinced that this is a serious security issue, and Ubuntu seem to
have been treating this as an Ubuntu-specific thing rather than talking
to upstream about it, so I've reported it here as important rather
than grave.

A mitigation is that in Debian (unlike Ubuntu), socket activation for
sshd is not the default - I suspect that might be why Ubuntu treated
this as Ubuntu-specific.

I think older Debian suites are *probably* affected, hence marking this
bug as Found in all older releases, but I have not verified this: it's
possible that there is some reason why they are unaffected.

Unless the security team have reasons to want this to be treated as
urgent, I would suggest that instead of rushing to apply Ubuntu's
solution, we should see what happens upstream, and then follow that in
Debian when the dust has settled.

    smcv

Hi Simon,

Thanks for filling the bugreport. Indeed I added this morning the CVE
to the tracker:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/49490cb8e169308cd6130d0e0a9c02af53d5408f

I do agree with you, let that first fix upstream and then we can go
top down in Debian as well with the regular supported suites.

Thanks for your diligent work!

Regards,
Salvatore

Technically, Robert Ancell is also an upstream maintainer.

Thank you,
Jeremy Bícha

Hi Simon,

Agreed, this isn't an issue we need to rush a fix for.

Cheers,
        Moritz

Hi Simon,

Agreed, this isn't an issue we need to rush a fix for.

Cheers,
        Moritz