OPENSSH VERSION INSTALL

The NVD however rates it Medium severity. A future update may address this issue.' Further down it states 'Will not fix'. An attacker could use this flaw to determine whether given usernames exist or not on the server, but no further information is disclosed and there is no availability or integrity impact. If you check the RH link below they say: 'Red Hat Product Security has rated this issue as having Low severity. I checked the changelog for openssh and the last change was made was over a year ago: So when they fix it in RHEL 8 it will be backported to earlier versions? So you can see, installing Fedora packages on RHEL to receive security updates eventually becomes a dead end. Such a system would have been better sticking with the RHEL package. Meanwhile, the RHEL6 OpenSSH package continues to receive security updates well beyond the lifespan of Fedora 14. You're left with a RHEL6 system with Fedora 14 OpenSSH, and no upgrade path. The F15-onwards packages need a glibc later than what RHEL6 can provide.

OPENSSH VERSION INSTALL

That Fedora release updated the glibc to something which is not compatible with RHEL6, so now you won't be able to install Fedora packages anymore. Now try to install the openssh package from Fedora 15.

So far you are updating your OpenSSH version successfully. Now install the openssh package from Fedora 14. An attacker could exploit this to gain access to sensitive information. A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration. Now install the openssh package from Fedora 13. The version of OpenSSH running on the remote host has an information disclosure vulnerability. So install the openssh package from Fedora 12. That openssh package is probably vulnerable to a few things. Eventually you won't be able to install Fedora packages on RHEL anymore because of this. I'm not talking about updating the glibc package, I'm talking about Fedora updating its glibc, which is a dependency of other packages.

Openssh version