OpenSSH -- remote code execution via a forwarded agent socket

OpenSSH project reports:

Fix CVE-2023-38408 - a condition where specific libaries loaded via
ssh-agent(1)'s PKCS#11 support could be abused to achieve remote
code execution via a forwarded agent socket if the following
conditions are met:

    * Exploitation requires the presence of specific libraries on
  the victim system.
    * Remote exploitation requires that the agent was forwarded
  to an attacker-controlled system.

    Exploitation can also be prevented by starting ssh-agent(1) with an
    empty PKCS#11/FIDO allowlist (ssh-agent -P '') or by configuring
    an allowlist that contains only specific provider libraries.

    This vulnerability was discovered and demonstrated to be exploitable
    by the Qualys Security Advisory team.