Security Advisory 0100

Security Advisory 0100 PDF Date: July 8, 2024 Revision | Date | Changes ---|---|--- 1.0 | July 8th, 2024 | Initial release 1.1 | September 24th, 2024 | Update the fixed release info for affected products 1.2 | July 22nd, 2025 | Add CVE-2024-6409 affected info and update hotfix to version 2.0 whic...

OpenSSH Security Vulnerabilities

OpenSSH OpenBSD Secure Shell is a set of connection tools for secure access to remote computers from the Canadian OpenBSD Project Group. The tools are an open source implementation of the SSH protocol and support encryption of all transmissions, effectively blocking eavesdropping, connection...

PT-2024-4669

Name of the Vulnerable Software and Affected Versions: OpenSSH versions 8.7 and 8.8 Description: A race condition vulnerability was discovered in how signals are handled by OpenSSH's server sshd. If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is...

CVE-2024-6409: Signal Handler Race Condition

A race condition vulnerability was discovered in how signals are handled by OpenSSH's server sshd. If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not...

CVE-2024-6409

A race condition vulnerability was discovered in how signals are handled by OpenSSH's server sshd. If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not...

RHEL 9 : openssh (RHSA-2024:4389)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4389 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary f...

CVE-2024-6387: New OpenSSH RegreSSHion Vulnerability Gives Hackers Root Access on Linux Servers – 700,000+ Linux Boxes Potentially at Risk

Labeled as CVE-2024-6387, the recently discovered vulnerability in OpenSSH has become a serious cause for concern among Linux servers. OpenSSH is a collection of networking tools built on the Secure Shell SSH protocol. It is widely utilized to secure remote logins, manage and administer remote...

Important: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

openssh: regreSSHion - race condition in SSH allows RCE/DoS

A security regression CVE-2006-5051 was discovered in OpenSSH's server sshd. There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period...

RHEL 9 : openssh (RHSA-2024:4340)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4340 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary f...

openSUSE 15 Security Update : openssh (SUSE-SU-2024:2275-2)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:2275-2 advisory. - CVE-2024-6387: Fixed race condition in a signal handler bsc1226642 Tenable has extracted the preceding description block directly from the SUSE security...

AlmaLinux 9 : openssh (ALSA-2024:4312)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:4312 advisory. openssh: Possible remote code execution due to a race condition in signal handling CVE-2024-6387 Tenable has extracted the preceding description block directly fro...

CVE-2024-6387 affecting package openssh for versions less than 8.9p1-6

CVE-2024-6387 affecting package openssh for versions less than 8.9p1-6. A patched version of the package is available...

Exploit for Race Condition in Openbsd Openssh

0.省流 这本质上是一种统计漏洞：需要进行大量尝试才能赢得竞争条件并成功执行任意代码，攻击者需要克服很多障碍，”Schwa...

CLSA-2024-1720093829 openssh: Fix of CVE-2024-6387

CVE-2024-6387: the signal handler race condition itself fixed by commenting out the async-signal-unsafe code from the sshsigdie function...

Exploit for Race Condition in Openbsd Openssh

CVE-2024-6387-OpenSSH-Vulnerability-Checker This repository co...

SUSE CVE-2024-39894

OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry e.g., for su and Sudo because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur...

openssh security update

8.7p1-38.0.2.1 - Update upstream references Orabug: 36564626 8.7p1-38.1 - Possible remote code execution due to a race condition CVE-2024-6387 Resolves: RHEL-45347...

ROS-20240704-01

The OpenSSH cryptographic security tool server vulnerability is related to the reuse of previously reuse of previously freed memory due to competitive access to a resource race condition. Exploitation of the vulnerability could allow a remote attacker to execute arbitrary code with root privilege...

ROS-20240704-02

OpenSSH cryptographic protection tool server vulnerability is related to a logic error ObscureKeystrokeTiming. Exploitation of the vulnerability could allow an attacker acting remotely, launch a timing attack...