ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | openssh | < 1:8.4p1-5 | openssh_1:8.4p1-5_all.deb |
Debian | 11 | all | openssh | < 1:8.4p1-5 | openssh_1:8.4p1-5_all.deb |
Debian | 10 | all | openssh | < 1:7.9p1-10+deb10u2 | openssh_1:7.9p1-10+deb10u2_all.deb |
Debian | 999 | all | openssh | < 1:8.4p1-5 | openssh_1:8.4p1-5_all.deb |
Debian | 13 | all | openssh | < 1:8.4p1-5 | openssh_1:8.4p1-5_all.deb |