DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 525KGNbo083293
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 036523858D26
To: Dimitry Andric <dimitry AT unified-streaming DOT com>
CC: "cygwin AT cygwin DOT com" <cygwin AT cygwin DOT com>
Subject: RE: Cygwin OpenSSH version detection by Tenable
Thread-Topic: Cygwin OpenSSH version detection by Tenable
Thread-Index: AduOAPHOsHnB3EXRQw6wdpJBkEJJ6AABtR4AAAAciXA=
Date: Wed, 5 Mar 2025 20:15:09 +0000
Message-ID: <PH0PR84MB1836F2EBAF6880F07A9D85FCA5CB2@PH0PR84MB1836.NAMPRD84.PROD.OUTLOOK.COM>
References: <PH0PR84MB18364E960950D1F0C2080315A5CB2 AT PH0PR84MB1836 DOT NAMPRD84 DOT PROD DOT OUTLOOK DOT COM>
 <19A5E907-7DDF-4FB8-9004-0C8A6B269C1A AT unified-streaming DOT com>
In-Reply-To: <19A5E907-7DDF-4FB8-9004-0C8A6B269C1A@unified-streaming.com>
Accept-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?iLMtCSZNfZgPGp3uZAnnFqFlRe2KcDVzErBvz79tgGk9Lk0slogAlkEFfvto?=
 =?us-ascii?Q?qwOhaBSiS6Hrl+Ft5Zr3iEmJwP+DNJea3vTrBTYKXlodVqCoYIDS982YmPWd?=
 =?us-ascii?Q?B2w+P91TPOzeQSc6bTlqnw7mPRWWt5jA1VxmNL2TJtpWv8XrOb/+V4LHAghS?=
 =?us-ascii?Q?c4bDTmoGNrRYchzQRsOgzmH+ZizEQvWy505vGvr3OYuUYj+25Cp5pUACfugo?=
 =?us-ascii?Q?+eGOI/IQeeSNv4aBwJxl3VPiPdF11/6CIR23hcmTzU0racDeVyyZkF5UIin5?=
 =?us-ascii?Q?2Y9EbbrQRaQ2YK8wfRtkl7ZKc+E+rDxUDo5Ko7VdpTLGMgT4pZDGlUC52cPX?=
 =?us-ascii?Q?NMWbFNcaelsv78IRMzSH9GKUq4Fl5DC+vnK9mJHSjRWuC8MWPAVwl5gVRQGh?=
 =?us-ascii?Q?Y99Nd19s1ta5MlQg/56zGf8BOE6s8pJXEUtpUc74nEVkU+FuFo8t73gWzmCX?=
 =?us-ascii?Q?UAu1LKInlVXWjtmq9Cqd5SD/fTOIZGsAaG12/+K9Gzl2OjadLYp9C1QwkgXA?=
 =?us-ascii?Q?iEc4YTjwfQ5yajrf/IyPBsM+XutmbB+9cNEiq+vgXR0m174pVXsU3n7vKdQC?=
 =?us-ascii?Q?KSY0ldV0NvIlnZYwXrlbZwfEO1m9eq6fdiQqKhpkNm+JSQB4NCReIH41//3+?=
 =?us-ascii?Q?5L8GlcPgekLkBqsHIJ+MIayu7zwwfWJK2ZFJKciYb2DLlpgFAQeuWNc0RLy+?=
 =?us-ascii?Q?dvKEEOIqqZt5VXD9dEbLQG/DWbbW44MJlPFBvWp+IPuqgJ0iXp/KsTKCs1t6?=
 =?us-ascii?Q?KMBblY23fz8pA5WyuOgSBYt3F4g2WIiAl5V2gd23EOeQVlYMK6JYX70enFCL?=
 =?us-ascii?Q?f0ygiBaw8Rr85o1ii49XYeJFB1pkk0hcO9d+PogaDSGESHllrMjHpggdJFL+?=
 =?us-ascii?Q?UYbuGyTM1QANm6PMo1D8Fxc7A4YzSPqhnET4h4OVC9mKGs4KW5f1XY6J6KWG?=
 =?us-ascii?Q?DJoWHC9ouoRm713S8Sna9Q3ZRWa6ITLGtasIhn9ERmTr6tyJ7AjUej1R5zz9?=
 =?us-ascii?Q?+rXf1RPWcT+RtUt0koUHWmjPAUwEDnbYUjZoZVv06jCWJRqTfS8YTO2/xwE/?=
 =?us-ascii?Q?aYcwRN5h0+m4SYPG2BidyZZUP+rpm69DbMUszzjFiMjB9qwyRSypMSuYyE5b?=
 =?us-ascii?Q?2eUQ75bLqjm+Fda/BqKhK0C4DbEtwePsKLiFekTsehsyi7XWsXIbDaU7+s30?=
 =?us-ascii?Q?AMWS53szhnvLC4+r0md5bUHgmUndbZ4CQph3ST3nhUOyRsnDatGdEwoSP8NG?=
 =?us-ascii?Q?bzCcIzeuedMrQSd9A1+tVLTV8oTk+neZEnkxghq8aATB8883sqklp39sjdhp?=
 =?us-ascii?Q?zOhS0hhKGEzi25WuQmfSeR/A6iTUN0ep9uYWn0NNhDp8Fv5xW6h1H9h2Ae5n?=
 =?us-ascii?Q?RUgmYz/wvRftd2oGMaOiPWhdCJiG7mwLJ4DcjWttaJQIQL3XnktL5bvItlil?=
 =?us-ascii?Q?ebRqY17nX0OOI6YjhMY980imUUsulNFvFeUL5p1d3SMUbQxxR019ZzOpHOsQ?=
 =?us-ascii?Q?IjEcblXAFpADUNUpkzkRm7c0XrrQcjRYnJv+Fw6AMqhFc39IzEi6Dlu4Z1BQ?=
 =?us-ascii?Q?uDNqLrOb8IVW5rJgNow=3D?=
MIME-Version: 1.0
X-OriginatorOrg: hp.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PH0PR84MB1836.NAMPRD84.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: 0f6ec42a-07d5-4d5b-a401-08dd5c226d99
X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Mar 2025 20:15:09.3881 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: ca7981a2-785a-463d-b82a-3db87dfc3ce6
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: fAEUgqRvB9AwIbJVYYjyp9SsB1giJKIot+HHHvbkSDDQo5obkGUOYKn/gpt7EkaRnL13GNB9+85+qa85I1fOhg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR84MB1724
X-Mimecast-Spam-Score: 0
X-Mimecast-MFC-PROC-ID: VUXZcmyu8iCT8sYuwYXnCIbmxlf-hcSlzoMxHn6j4HM_1741205710
X-Mimecast-Originator: hp.com
Content-Language: en-US
X-Content-Filtered-By: Mailman/MimeDel 2.1.30
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.30
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From: "SUMMERS, TED via Cygwin" <cygwin AT cygwin DOT com>
Reply-To: "SUMMERS, TED" <ted DOT summers1 AT hp DOT com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>

Dimitry-
Thanks for your response.
You have been very helpful.
I agree with your statement relating to the version determination.
I will await if the maintainer has any response before formulating my next action.

If necessary, I can take this information you provided back to Tenable team and try to make the case that Tenable needs to change it's method or get an exception.

Best Regards,
Ted Summers

From: Dimitry Andric <dimitry AT unified-streaming DOT com>
Sent: Wednesday, March 5, 2025 11:50 AM
To: SUMMERS, TED <ted DOT summers1 AT hp DOT com>
Cc: cygwin AT cygwin DOT com
Subject: Re: Cygwin OpenSSH version detection by Tenable

CAUTION: External Email
In my opinion, it is wrong that scanners rely on this information. :-) But putting that discussion aside, the openssh-portable distribution does not announce its "patch level" in its version banner by default.

See e.g. https://github.com/openssh/openssh-portable/blob/master/version.h<https://github.com/openssh/openssh-portable/blob/master/version.h>, where SSH_VERSION is defined as "OpenSSH_9.9", while SSH_PORTABLE is defined as "p2".

In https://github.com/openssh/openssh-portable/blob/master/ssh_api.c#L430<https://github.com/openssh/openssh-portable/blob/master/ssh_api.c#L430> you can see that the _ssh_send_banner() function only advertises the SSH_VERSION value, not the SSH_PORTABLE value.

Now, various Linux distributions apply custom patches on top of the stock openssh-portable package to add additional information, for example Debian (and Ubuntu which sources its packages from there) has:

https://salsa.debian.org/ssh-team/openssh/-/blob/master/debian/patches/package-versioning.patch?ref_type=heads<https://salsa.debian.org/ssh-team/openssh/-/blob/master/debian/patches/package-versioning.patch?ref_type=heads>

I guess something similar could be done in the Cygwin package. This is up to the Cygwin maintainers of course.

-Dimitry

> On 5 Mar 2025, at 20:30, SUMMERS, TED via Cygwin <cygwin AT cygwin DOT com<mailto:cygwin AT cygwin DOT com>> wrote:
>
> Dear list member(s),
>
> I've reviewed the list archives for the last two months since subcomponent release, and googled, but didn't find an answer for my question.
>
> I'm encountering an issue with Tenable detecting a difference in version in our security scans indicating that OpenSSH is still at a vulnerable version.
> Even though I have openssh 9.9p2-1 installed, some query methods show the version only as OpenSSH 9.9.
> IF I login to my Cygwin installation and perform "ssh -V" I receive the expected correct up-to-date values in the response:
> OpenSSH_9.9p2, OpenSSL 3.0.16 11 Feb 2025
>
> However Tenable is performing a non-authenticated query against ssh that returns OpenSSH 9.9 (without the p2 appended to the end).
> Then Tenable flags systems for remediation of what it detects as a vulnerable version.
>
> If I initiate a command "ssh -vv <host ip>" I can see the string where it reports the following:
> debug1: Remote protocol version 2.0, remote software version OpenSSH_9.9
>
> I can also get this information via nmap or netcat (nc)
> Nmap (v7.94) returns:
> 22/tcp open ssh OpenSSH 9.9 (protocol 2.0)
>
> # nc <ip address> 22
> SSH-2.0-OpenSSH_9.9
>
> Is there a file that I can manipulate to resolve this, or can a new openssh package build be made that fixes the version output in response to these other query methods used by security scanners?
>
> I look forward to any response or guidance.
>
> Respectfully,
> Ted Summers
>
>
>
>
>
>
> --
> Problem reports: https://cygwin.com/problems.html<https://cygwin.com/problems.html>
> FAQ: https://cygwin.com/faq/<https://cygwin.com/faq>
> Documentation: https://cygwin.com/docs.html<https://cygwin.com/docs.html>
> Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple<https://cygwin.com/ml/#unsubscribe-simple>

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple