Lucene search

K

ROSA LABROSA-SA-2024-2340

HistoryFeb 14, 2024 - 9:58 a.m.

Advisory ROSA-SA-2024-2340

2024-02-1409:58:40

ROSA LAB

abf.rosalinux.ru

14

openssh

rosa-sa-2024-2340

remote execution

vulnerability

resolved

argument injection

modification

security tool

yum update

unix

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

8.3

Confidence

Low

EPSS

0.003

Percentile

67.8%

Software: openssh 7.4p1
OS: rosa-server79

package_evr_string: openssh-7.4p1-23.0.1.res7

CVE-ID: CVE-2023-51385
BDU-ID: 2023-08955
CVE-Crit: MEDIUM
CVE-DESC.: A vulnerability in the SSH protocol implementation of the OpenSSH cryptographic security tool is related to an argument injection or modification. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary commands
CVE-STATUS: Resolved
CVE-REV: To close, run the yum update openssh command

OSVersionArchitecturePackageVersionFilename
rosaanynoarchopenssh< 7.4UNKNOWN

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

8.3

Confidence

Low

EPSS

0.003

Percentile

67.8%

Related for ROSA-SA-2024-2340