Security
Headlines
HeadlinesLatestCVEs

Headline

Red Hat Security Advisory 2023-4329-01

Red Hat Security Advisory 2023-4329-01 - OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Issues addressed include a code execution vulnerability.

Packet Storm
#vulnerability#linux#red_hat#rce#auth#ssh

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: openssh security update
Advisory ID: RHSA-2023:4329-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:4329
Issue date: 2023-07-31
CVE Names: CVE-2023-38408
=====================================================================

  1. Summary:

An update for openssh is now available for Red Hat Enterprise Linux 9.0
Extended Update Support.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

  1. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream EUS (v.9.0) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux BaseOS EUS (v.9.0) - aarch64, ppc64le, s390x, x86_64

  1. Description:

OpenSSH is an SSH protocol implementation supported by a number of Linux,
UNIX, and similar operating systems. It includes the core files necessary
for both the OpenSSH client and server.

Security Fix(es):

  • openssh: Remote code execution in ssh-agent PKCS#11 support
    (CVE-2023-38408)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

  1. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the OpenSSH server daemon (sshd) will be
restarted automatically.

  1. Bugs fixed (https://bugzilla.redhat.com/):

2224173 - CVE-2023-38408 openssh: Remote code execution in ssh-agent PKCS#11 support

  1. Package List:

Red Hat Enterprise Linux AppStream EUS (v.9.0):

aarch64:
openssh-askpass-8.7p1-11.el9_0.aarch64.rpm
openssh-askpass-debuginfo-8.7p1-11.el9_0.aarch64.rpm
openssh-clients-debuginfo-8.7p1-11.el9_0.aarch64.rpm
openssh-debuginfo-8.7p1-11.el9_0.aarch64.rpm
openssh-debugsource-8.7p1-11.el9_0.aarch64.rpm
openssh-keycat-debuginfo-8.7p1-11.el9_0.aarch64.rpm
openssh-server-debuginfo-8.7p1-11.el9_0.aarch64.rpm
pam_ssh_agent_auth-0.10.4-4.11.el9_0.aarch64.rpm
pam_ssh_agent_auth-debuginfo-0.10.4-4.11.el9_0.aarch64.rpm

ppc64le:
openssh-askpass-8.7p1-11.el9_0.ppc64le.rpm
openssh-askpass-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
openssh-clients-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
openssh-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
openssh-debugsource-8.7p1-11.el9_0.ppc64le.rpm
openssh-keycat-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
openssh-server-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
pam_ssh_agent_auth-0.10.4-4.11.el9_0.ppc64le.rpm
pam_ssh_agent_auth-debuginfo-0.10.4-4.11.el9_0.ppc64le.rpm

s390x:
openssh-askpass-8.7p1-11.el9_0.s390x.rpm
openssh-askpass-debuginfo-8.7p1-11.el9_0.s390x.rpm
openssh-clients-debuginfo-8.7p1-11.el9_0.s390x.rpm
openssh-debuginfo-8.7p1-11.el9_0.s390x.rpm
openssh-debugsource-8.7p1-11.el9_0.s390x.rpm
openssh-keycat-debuginfo-8.7p1-11.el9_0.s390x.rpm
openssh-server-debuginfo-8.7p1-11.el9_0.s390x.rpm
pam_ssh_agent_auth-0.10.4-4.11.el9_0.s390x.rpm
pam_ssh_agent_auth-debuginfo-0.10.4-4.11.el9_0.s390x.rpm

x86_64:
openssh-askpass-8.7p1-11.el9_0.x86_64.rpm
openssh-askpass-debuginfo-8.7p1-11.el9_0.x86_64.rpm
openssh-clients-debuginfo-8.7p1-11.el9_0.x86_64.rpm
openssh-debuginfo-8.7p1-11.el9_0.x86_64.rpm
openssh-debugsource-8.7p1-11.el9_0.x86_64.rpm
openssh-keycat-debuginfo-8.7p1-11.el9_0.x86_64.rpm
openssh-server-debuginfo-8.7p1-11.el9_0.x86_64.rpm
pam_ssh_agent_auth-0.10.4-4.11.el9_0.x86_64.rpm
pam_ssh_agent_auth-debuginfo-0.10.4-4.11.el9_0.x86_64.rpm

Red Hat Enterprise Linux BaseOS EUS (v.9.0):

Source:
openssh-8.7p1-11.el9_0.src.rpm

aarch64:
openssh-8.7p1-11.el9_0.aarch64.rpm
openssh-askpass-debuginfo-8.7p1-11.el9_0.aarch64.rpm
openssh-clients-8.7p1-11.el9_0.aarch64.rpm
openssh-clients-debuginfo-8.7p1-11.el9_0.aarch64.rpm
openssh-debuginfo-8.7p1-11.el9_0.aarch64.rpm
openssh-debugsource-8.7p1-11.el9_0.aarch64.rpm
openssh-keycat-8.7p1-11.el9_0.aarch64.rpm
openssh-keycat-debuginfo-8.7p1-11.el9_0.aarch64.rpm
openssh-server-8.7p1-11.el9_0.aarch64.rpm
openssh-server-debuginfo-8.7p1-11.el9_0.aarch64.rpm
pam_ssh_agent_auth-debuginfo-0.10.4-4.11.el9_0.aarch64.rpm

ppc64le:
openssh-8.7p1-11.el9_0.ppc64le.rpm
openssh-askpass-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
openssh-clients-8.7p1-11.el9_0.ppc64le.rpm
openssh-clients-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
openssh-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
openssh-debugsource-8.7p1-11.el9_0.ppc64le.rpm
openssh-keycat-8.7p1-11.el9_0.ppc64le.rpm
openssh-keycat-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
openssh-server-8.7p1-11.el9_0.ppc64le.rpm
openssh-server-debuginfo-8.7p1-11.el9_0.ppc64le.rpm
pam_ssh_agent_auth-debuginfo-0.10.4-4.11.el9_0.ppc64le.rpm

s390x:
openssh-8.7p1-11.el9_0.s390x.rpm
openssh-askpass-debuginfo-8.7p1-11.el9_0.s390x.rpm
openssh-clients-8.7p1-11.el9_0.s390x.rpm
openssh-clients-debuginfo-8.7p1-11.el9_0.s390x.rpm
openssh-debuginfo-8.7p1-11.el9_0.s390x.rpm
openssh-debugsource-8.7p1-11.el9_0.s390x.rpm
openssh-keycat-8.7p1-11.el9_0.s390x.rpm
openssh-keycat-debuginfo-8.7p1-11.el9_0.s390x.rpm
openssh-server-8.7p1-11.el9_0.s390x.rpm
openssh-server-debuginfo-8.7p1-11.el9_0.s390x.rpm
pam_ssh_agent_auth-debuginfo-0.10.4-4.11.el9_0.s390x.rpm

x86_64:
openssh-8.7p1-11.el9_0.x86_64.rpm
openssh-askpass-debuginfo-8.7p1-11.el9_0.x86_64.rpm
openssh-clients-8.7p1-11.el9_0.x86_64.rpm
openssh-clients-debuginfo-8.7p1-11.el9_0.x86_64.rpm
openssh-debuginfo-8.7p1-11.el9_0.x86_64.rpm
openssh-debugsource-8.7p1-11.el9_0.x86_64.rpm
openssh-keycat-8.7p1-11.el9_0.x86_64.rpm
openssh-keycat-debuginfo-8.7p1-11.el9_0.x86_64.rpm
openssh-server-8.7p1-11.el9_0.x86_64.rpm
openssh-server-debuginfo-8.7p1-11.el9_0.x86_64.rpm
pam_ssh_agent_auth-debuginfo-0.10.4-4.11.el9_0.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

  1. References:

https://access.redhat.com/security/cve/CVE-2023-38408
https://access.redhat.com/security/updates/classification/#important

  1. Contact:

The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJkx8M/AAoJENzjgjWX9erEXxEP/2v6d41soiJeC4s8E8oBYSMV
nMliXdwT2hQ4Ld+qgzFKw+xAroNaGvtS28okVqtM/YzFi1s68DUoOoy7M1FLDs8p
xANDyQ8P0oxIz+wouX55+8cad3GZiuzDP0T+CSqq+q+RpmMP2/bvoFbGYFSf8AAk
8XehQcPMm4quEv+VP26bIlBUuxfAl8ZZzPJGEFQegVCqy6zupFGmzpojeIvHrvMb
WPNN0cBMQQtgi81opawWkV3zscSE6UryGGrS6hh/n7yFjnZtrGVsTOAXRLX9ru6b
lkF9tN3A//LLjcmKpxkNdLn0B2+uU7ONSFy9OxgaXTTlCmRg2Rw0SDu/Pm0SNaqN
IY+p2yO1DXl5RYJqrnIq3/iBC+L3GeyhpjMdj2BDC4HRhQ0s5Ygpskc2xKvxSyQf
qg5Xl0OchWMFr4u7fRvj7pY7q/HXRSNasn+ZIuPt+cSO+Scw99I4Y9FJzYjWrFzg
mrq3zu7OzVIcjFxa+HfbRvhm3NbIVMcbuG2KEopdQRZ9r1MHLDFxmWWuOtNcavFd
bXzerei012+UMeV3R1oalmJaRdQNFKAHgTbDCV6tBxwgEDm1Z0rDwlFPdbnTA1Vk
OO6LhMyGuNPd03zRV1aiBEdniN0HGi5MucgK9+LorXdGqZ2PFc5wKmsaXQENiUaY
YXBTCnnpgSw5dBDBy8Gj
=ZYYk
-----END PGP SIGNATURE-----

RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Related news

CVE-2023-48660: DSA-2023-443: Dell PowerMaxOS 5978, Dell Unisphere 360, Dell Unisphere for PowerMax, Dell Unisphere for PowerMax Virtual Appliance, Dell Solutions Enabler Virtual Appliance, and Dell PowerMax EEM Secu

Dell vApp Manger, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote attacker could potentially exploit this vulnerability to read arbitrary files from the target system.

CVE-2023-30994: Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities

IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 254138

Red Hat Security Advisory 2023-5103-01

Red Hat Security Advisory 2023-5103-01 - OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization 4.11.6 images.

RHSA-2023:5029: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

An update is now available for Red Hat OpenShift GitOps 1.9. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-40029: A flaw was found in the ArgoCD package, used by Red Hat GitOps, that allows cluster secrets to be managed declaratively using the `kubectl apply` functionality, resulting in the full secret body being stored in `kubectl.kubernetes.io/last-applied-configuration` annotation. Since ArgoCD has included the ability to manage cluster labels and annotations via i...

Red Hat Security Advisory 2023-4982-01

Red Hat Security Advisory 2023-4982-01 - OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization 4.12.6 images.

Red Hat Security Advisory 2023-4972-01

Red Hat Security Advisory 2023-4972-01 - Multicluster Engine for Kubernetes 2.1.8 images Multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy. Issues addressed include a bypass vulnerability.

Red Hat Security Advisory 2023-4893-01

Red Hat Security Advisory 2023-4893-01 - The Migration Toolkit for Containers enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API.

RHSA-2023:4889: Red Hat Security Advisory: DevWorkspace Operator 0.22 release

Red Hat DevWorkspace Operator 0.22 has been released. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38408: A vulnerability was found in OpenSSH. The PKCS#11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system (the code in /usr/lib is not necessarily safe for loading into ssh-agent). This flaw allows an attacker with control of the forwarded agent-...

Red Hat Security Advisory 2023-4875-01

Red Hat Security Advisory 2023-4875-01 - Red Hat Advanced Cluster Management for Kubernetes 2.8.1 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which provide security updates and fix several bugs. Issues addressed include bypass and privilege escalation vulnerabilities.

CVE-2023-40371: Security Bulletin: AIX is vulnerable to unauthorized file access and arbitrary code execution due to OpenSSH (CVE-2023-40371 and CVE-2023-38408)

IBM AIX 7.2, 7.3, VIOS 3.1's OpenSSH implementation could allow a non-privileged local user to access files outside of those allowed due to improper access controls. IBM X-Force ID: 263476.

Red Hat Security Advisory 2023-4650-01

Red Hat Security Advisory 2023-4650-01 - Multicluster Engine for Kubernetes 2.2.7 images Multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.

Red Hat Security Advisory 2023-4576-01

Red Hat Security Advisory 2023-4576-01 - VolSync is a Kubernetes operator that enables asynchronous replication of persistent volumes within a cluster, or across clusters.

Red Hat Security Advisory 2023-4456-01

Red Hat Security Advisory 2023-4456-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.13.8. Issues addressed include an add administrator vulnerability.

Red Hat Security Advisory 2023-4428-01

Red Hat Security Advisory 2023-4428-01 - OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Issues addressed include a code execution vulnerability.

Red Hat Security Advisory 2023-4419-01

Red Hat Security Advisory 2023-4419-01 - OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Issues addressed include a code execution vulnerability.

RHSA-2023:4428: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38408: A vulnerability was found in OpenSSH. The PKCS#11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system (the code in /usr/lib is not necessarily safe for loading into ssh-agent). This flaw allows an a...

Ubuntu Security Notice USN-6242-2

Ubuntu Security Notice 6242-2 - USN-6242-1 fixed a vulnerability in OpenSSH. This update provides the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. It was discovered that OpenSSH incorrectly handled loading certain PKCS#11 providers. If a user forwarded their ssh-agent to an untrusted system, a remote attacker could possibly use this issue to load arbitrary libraries from the user's system and execute arbitrary code.

RHSA-2023:4382: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38408: A vulnerability was found in OpenSSH. The PKCS#11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system (the code in /usr/lib is not necessarily safe for loading into ssh-agent). This flaw allows an attacker with control of the...

RHSA-2023:4384: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38408: A vulnerability was found in OpenSSH. The PKCS#11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarde...

RHSA-2023:4383: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38408: A vulnerability was found in OpenSSH. The PKCS#11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system (the code in /usr/lib is not necessarily safe for loading into ssh-agent). This flaw al...

RHSA-2023:4381: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38408: A vulnerability was found in OpenSSH. The PKCS#11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an ...

RHSA-2023:4329: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38408: A vulnerability was found in OpenSSH. The PKCS#11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system (the code in /usr/lib is not necessarily safe for loading into ssh-agent). This flaw allows an at...

Ubuntu Security Notice USN-6242-1

Ubuntu Security Notice 6242-1 - It was discovered that OpenSSH incorrectly handled loading certain PKCS#11 providers. If a user forwarded their ssh-agent to an untrusted system, a remote attacker could possibly use this issue to load arbitrary libraries from the user's system and execute arbitrary code.

New OpenSSH Vulnerability Exposes Linux Systems to Remote Command Injection

Details have emerged about a now-patched flaw in OpenSSH that could be potentially exploited to run arbitrary commands remotely on compromised hosts under specific conditions. "This vulnerability allows a remote attacker to potentially execute arbitrary commands on vulnerable OpenSSH's forwarded ssh-agent," Saeed Abbasi, manager of vulnerability research at Qualys, said in an analysis last week.

OpenSSH Forwarded SSH-Agent Remote Code Execution

The PKCS#11 feature in ssh-agent in OpenSSH versions prior to 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system.

CVE-2023-38408: Disallow remote addition of FIDO/PKCS11 provider libraries to · openbsd/src@7bc29a9

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

Packet Storm: Latest News

Zeek 6.0.9