DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 525JVXrd064930
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 7E7113858C2D
To: "cygwin AT cygwin DOT com" <cygwin AT cygwin DOT com>
Subject: Cygwin OpenSSH version detection by Tenable
Thread-Topic: Cygwin OpenSSH version detection by Tenable
Thread-Index: AduOAPHOsHnB3EXRQw6wdpJBkEJJ6A==
Date: Wed, 5 Mar 2025 19:30:22 +0000
Message-ID: <PH0PR84MB18364E960950D1F0C2080315A5CB2@PH0PR84MB1836.NAMPRD84.PROD.OUTLOOK.COM>
Accept-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?qCyYrwkqOs5aS33xWMKV48hTL3MwNDfNCqEYUoLZ98i9rcjD9jsBc8Trrq5C?=
 =?us-ascii?Q?4oMQKnzcQBsBjmqxOVlWSMFjztg7tCQt30anjgp+nBVlS3STMfzpZVKtwVgv?=
 =?us-ascii?Q?sJW1FnGuuiWMILbJOr3NN1QUKvUgynv1kqgWKhGhnqcpXkVs6H3w5s4YII+F?=
 =?us-ascii?Q?Ed2A/vwTuBc6CCuXmyP2FbnVAfY9lSfVvf9LPkTwwmDXrTWtfG/ycSOdNFKt?=
 =?us-ascii?Q?6uPbVPl1t+W4ifF7UThL6Ed2bUD816fxmtKdTvH4TpYDD5TNvggS3fE+3J8d?=
 =?us-ascii?Q?zJlbka+Wox8GNqfeF6x0E3J5lABZtPe8bKA5Ed1i60x/XV6pwwqNpFgpxyGB?=
 =?us-ascii?Q?GhLbhLDTJaIv5xCHrNpfvc5XnMysw6/+YpcqmxrxeKHRVXtapg3ClzVKwd1J?=
 =?us-ascii?Q?Fan897wZ808LwEj1FG8mrVFAgZjZ+L8qFt1xLLSVcxXSgQSJVqmZs9oBEZkR?=
 =?us-ascii?Q?Q8RXmgJ5C01qbPEel9q467HJLUL2V36iWQyLIp3wKrLSI1TFaed2Xz0MSQ2H?=
 =?us-ascii?Q?mBNnUdJy9LFg8Ad9T9cmedjQslpUafKO4Zu9YSk1aQtWZj+pEdEA/eTdkRN4?=
 =?us-ascii?Q?Z/j4kAXMGsy4SNy+gOVbXWCYLUOb4yNnVCO7g949EsCpJhpCZR/N5xc58veY?=
 =?us-ascii?Q?GK+L3tOJ0u1Cb8xBg83RCjiOSqq2yTRdk+9A5b1lXjseeGajwD+CMevbZu3F?=
 =?us-ascii?Q?csL+psoe/1qh5l2qkCHwOWcDTEWWqQz5OLySiljjM2eXPcKAUHWBWSE4rAHg?=
 =?us-ascii?Q?5+5jSHEpNn0EZtdl1T/T8brJZE7O1LosYM7kJPTzZJDLDkalk7iTHdbIKNJd?=
 =?us-ascii?Q?l0Ou69I5gO8FjbeYYMrnSUov33PEvcI2ACfYPvq3TwkYeNMd3MiYYJAz+BsG?=
 =?us-ascii?Q?Grmg8R+WhxMUf4N1J+m6eDz80DGSwy4cI5WAFdawl6CftSLLOvk3O3cSU8nM?=
 =?us-ascii?Q?2HwcuKfCMAscaWqEkGdusuiRRQQ+fnAsd2IQltgM6t/rdXbO0h3VF30fQsL1?=
 =?us-ascii?Q?QR0aIopFtKv2BeEb537USmJvYo6nbUG6voYsqsgeAwIeFFipqPIi4vUDDGty?=
 =?us-ascii?Q?rtIgO5qilzO2zTQTtUXXcpN45uvvXbpkIYz8JV0zJ+QrHip8zJdtfZ7wu5Yd?=
 =?us-ascii?Q?edxpkWdjn9JTHld4d5ex1NAuZ8ceOS9D0uBYR7Iv5ptYZQafKyoT9jxwZ151?=
 =?us-ascii?Q?C/EFxEPbVcj8VllpCsYOyCpYuXcdPpZNTEMdrS8q0SzRF1aI5BQFkSuojNzO?=
 =?us-ascii?Q?t/UgPrPcYWw4D6nkrIbS5E4NGeH4vYjGw+NLv4cyLWEsDmZq+BjXhTAy8Q/N?=
 =?us-ascii?Q?T003BbgrRQYa8hLTYW6VvD6WpUSsi6MYY7cwSO8p3DnWAD/D2wh2Cy1M4eIO?=
 =?us-ascii?Q?mG5QijzSlFIFat9bR4pydg7yZtC8d/qxKqoQsRrEC49LJcaTPIqdtBhQfW24?=
 =?us-ascii?Q?dgHOf38NcxuygrXBkrkZn6TQPOUGCYwtCwjZZZhGU1h+Z6q8YPsBKyR7b0JY?=
 =?us-ascii?Q?qSrksr92o9Q3848nVqTgLd5u5kXFhvS6IBoX/pUQJf9oou+xRn6ySQv905O8?=
 =?us-ascii?Q?q6Vq540MdkY7RqR4350=3D?=
MIME-Version: 1.0
X-OriginatorOrg: hp.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PH0PR84MB1836.NAMPRD84.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: a8044826-1b14-4aa7-2541-08dd5c1c2bfe
X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Mar 2025 19:30:22.3030 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: ca7981a2-785a-463d-b82a-3db87dfc3ce6
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: Y+v+FIk5VLGupKmSuqZmeRx65v7fa5kYpbeMgBdZZqTFQE4kEs53gkvs4/PStg8oKhSKoT+vUAnQN2UIUYDajA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV8PR84MB3968
X-Mimecast-Spam-Score: 0
X-Mimecast-MFC-PROC-ID: J05qXapcpZwuKGGCji6mVB8fA1E5CTFOSr3TIqWoXpA_1741203024
X-Mimecast-Originator: hp.com
Content-Language: en-US
X-Content-Filtered-By: Mailman/MimeDel 2.1.30
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.30
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From: "SUMMERS, TED via Cygwin" <cygwin AT cygwin DOT com>
Reply-To: "SUMMERS, TED" <ted DOT summers1 AT hp DOT com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>

Dear list member(s),

I've reviewed the list archives for the last two months since subcomponent release, and googled, but didn't find an answer for my question.

I'm encountering an issue with Tenable detecting a difference in version in our security scans indicating that OpenSSH is still at a vulnerable version.
Even though I have openssh 9.9p2-1 installed, some query methods show the version only as OpenSSH 9.9.
IF I login to my Cygwin installation and perform "ssh -V" I receive the expected correct up-to-date values in the response:
OpenSSH_9.9p2, OpenSSL 3.0.16 11 Feb 2025

However Tenable is performing a non-authenticated query against ssh that returns OpenSSH 9.9  (without the p2 appended to the end).
Then Tenable flags systems for remediation of what it detects as a vulnerable version.

If I initiate a command "ssh -vv <host ip>"  I can see the string where it reports the following:
debug1: Remote protocol version 2.0, remote software version OpenSSH_9.9

I can also get this information via nmap or netcat (nc)
Nmap (v7.94) returns:
22/tcp open  ssh        OpenSSH 9.9 (protocol 2.0)

# nc <ip address> 22
SSH-2.0-OpenSSH_9.9

Is there a file that I can manipulate to resolve this, or can a new openssh package build be made that fixes the version output in response to these other query methods used by security scanners?

I look forward to any response or guidance.

Respectfully,
Ted Summers


-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple