Mitigate CVE-2023-48795 by removing chacha20-poly1305 ssh cipher

[#186872602]
cloudfoundry · Feb 8, 2024 · 202056e · 202056e
1 parent 8a6bade
commit 202056e
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 1 deletion.
diff --git a/modules/BOSH.SSH/BOSH.SSH.Tests.ps1 b/modules/BOSH.SSH/BOSH.SSH.Tests.ps1
@@ -313,4 +313,19 @@ AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
         $result | Should -BeLike "#*#*"
     }
 
+    It "Disables the chacha20-poly1305 cipher to mitigate CVE-2023-48795" {
+
+        Mock Get-Content {
+@"
+# Ciphers and keying
+#RekeyLimit default none
+"@
+        } -ModuleName BOSH.SSH
+
+        $result = Modify-DefaultOpenSSHConfig -ConfigPath "some/path/sshd_config_default"
+
+        Assert-MockCalled Get-Content -Times 1 -ModuleName BOSH.SSH -Scope It -ParameterFilter { $Path -like "*sshd_config_default" }
+        $result | Should -BeLike "*#RekeyLimit default none`r`n# Disable cipher to mitigate CVE-2023-48795`r`nCiphers -chacha20-poly1305@openssh.com`r`n"
+    }
+
 }
diff --git a/modules/BOSH.SSH/BOSH.SSH.psm1 b/modules/BOSH.SSH/BOSH.SSH.psm1
@@ -137,7 +137,8 @@ function Modify-DefaultOpenSSHConfig
 
     $ModifiedConfig = Get-Content $ConfigPath `
     | %{$_ -replace ".*Match Group administrators.*", "#$&"} `
-    | %{$_ -replace ".*AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys.*", "#$&" }
+    | %{$_ -replace ".*AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys.*", "#$&" } `
+    | %{$_ -replace "#RekeyLimit default none", "$&`r`n# Disable cipher to mitigate CVE-2023-48795`r`nCiphers -chacha20-poly1305@openssh.com`r`n"}
 
     return $ModifiedConfig
 }