#1062930 openssh-client: ssh fails with "Connection corrupted" error when connecting to Oracle Linux systems

Package:
openssh-client
Source:
openssh-client
Description:
secure shell (SSH) client, for secure access to remote machines
Submitter:
Mike Quin
Date:
2024-02-06 12:21:03 UTC
Severity:
normal
#1062930#5
Date:
2024-02-04 01:16:37 UTC
From:
To:
Dear Maintainer,

Following the upgrade of the openssh-client and related packages to
1:9.2p1-2+deb12u2, ssh connections to Oracle Linux 8.9 systems running
their openssh server package 8.0p1-19.el8_9.2 have started to fail with:

Bad packet length 2605177462.
ssh_dispatch_run_fatal: Connection to REDACTED port 22: Connection corrupted

The number after "Bad packet length" changes with each connection attempt.

With the u1 version of openssh-client it was possible to connect to these systems.

Specifying that the aes256-gcm@openssh.com cipher be used rather than the
chacha20-poly1305@openssh.com works around the problem.

On the Oracle side, the openssh server package has recent changes related to
a couple of CVEs that may be relevant:

- Forbid shell metasymbols in username/hostname
  Resolves: CVE-2023-51385
- Fix Terrapin attack
  Resolves: CVE-2023-48795
#1062930#10
Date:
2024-02-06 12:10:18 UTC
From:
To:
Some discussion of this on Oracle’s GitHub:
https://github.com/oracle/oracle-linux/issues/125

They’ve acknowledged a problem on their customer support forums and the faulty openssl-server package has been withdrawn from their repositories.

There may be nothing for Debian to do on this one.

Mike Quin