In ssh-agent in OpenSSH before 9.6 certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys these constraints are only applied to the first key even if a PKCS#11 token returns multiple keys.

🗓️ 25 Dec 2023 08:00:00Reported by MicrosoftType

OpenSSH ssh-agent before nine six misapplies destination constraints to the first PKCS eleven key.

Reporter	Title	Published	Views	Family All 136
IBM Security Bulletins	Security Bulletin: AIX is vulnerable to a machine-in-the-middle attack (CVE-2023-48795), arbitrary command execution (CVE-2023-51385), and information disclosure (CVE-2023-51384) due to OpenSSH	14 Mar 202420:09	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access	12 Jan 202623:03	–	ibm
ATTACKERKB	CVE-2023-51384	18 Dec 202319:15	–	attackerkb
AlpineLinux	CVE-2023-51384	18 Dec 202300:00	–	alpinelinux
BDU FSTEC	The vulnerability of the ssh-agent agent in the OpenSSH encryption protection mechanism allows attackers to disclose the protected information.	21 Dec 202300:00	–	bdu_fstec
CBLMariner	CVE-2023-51384 affecting package openssh for versions less than 8.9p1-3	4 Jan 202419:54	–	cbl_mariner
CBLMariner	CVE-2023-51384 affecting package openssh for versions less than 9.7p1-1	17 May 202421:38	–	cbl_mariner
Cloud Foundry	USN-6565-1: OpenSSH vulnerabilities \| Cloud Foundry	29 Feb 202400:00	–	cloudfoundry
Circl	CVE-2023-51384	4 Jan 202407:51	–	circl
CNNVD	OpenSSH Security Vulnerabilities	18 Dec 202300:00	–	cnnvd