CVE-2023-40371

IBM AIX 7.2, 7.3, VIOS 3.1's OpenSSH implementation could allow a non-privileged local user to access files outside of those allowed due to improper access controls. IBM X-Force ID: 263476...

Improper access control

IBM AIX 7.2, 7.3, VIOS 3.1's OpenSSH implementation could allow a non-privileged local user to access files outside of those allowed due to improper access controls. IBM X-Force ID: 263476...

CVE-2023-40371 IBM AIX information disclosure

IBM AIX 7.2, 7.3, VIOS 3.1's OpenSSH implementation could allow a non-privileged local user to access files outside of those allowed due to improper access controls. IBM X-Force ID: 263476...

CVE-2023-40371

CVE-2023-40371 affects IBM AIX 7.2, 7.3 and VIOS 3.1 via OpenSSH, allowing a non-privileged local user to access files outside allowed boundaries due to improper access controls. The IBM advisory (openssh_fix15) lists fixed interim packages: openssh.base (versions 8.1.102.2106 and 9.2.112.2000) w...

CVE-2023-40371 IBM AIX information disclosure

IBM AIX 7.2, 7.3, VIOS 3.1's OpenSSH implementation could allow a non-privileged local user to access files outside of those allowed due to improper access controls. IBM X-Force ID: 263476...

IBM AIX 安全漏洞

IBM AIX is an open standards-based UNIX operating system developed for the IBM Power architecture by International Business Machines IBM. A security vulnerability exists in IBM AIX that stems from an unauthorized file access issue in OpenSSH that allows unprivileged local users to access files...

Security Bulletin: AIX is vulnerable to unauthorized file access and arbitrary code execution due to OpenSSH (CVE-2023-40371 and CVE-2023-38408)

Summary Vulnerabilities in AIX's OpenSSH could allow a non-privileged local user file access outside of those allowed CVE-2023-40371 or allow a remote attacker to execute arbitrary code CVE-2023-38408. OpenSSH is used by AIX for remote login. Vulnerability Details CVEID:CVE-2023-40371 DESCRIPTION...

AIX is vulnerable to unauthorized file access and arbitrary code execution due to OpenSSH

IBM SECURITY ADVISORY First Issued: Wed Aug 23 08:36:37 CDT 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/opensshadvisory15.asc Security Bulletin: AIX is vulnerable to unauthorized file access and arbitrary code execution due to...

Amazon Linux AMI : openssh (ALAS-2023-1802)

The version of openssh installed on the remote host is prior to 7.4p1-22.80. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1802 advisory. The PKCS11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code...

Important: openssh

Issue Overview: The PKCS11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if the target user's ssh-agent is forwarded to an attacker-controlled system the code in /usr/lib is not necessarily safe for loading into...

[SECURITY] [DLA 3532-1] openssh security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-3532-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta August 17, 2023 https://wiki.debian.org/LTS -...

OracleVM 3.4 : openssh (OVMSA-2023-0019)

The remote OracleVM system is missing necessary patches to address security updates: - sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate user...

Debian: Security Advisory (DLA-3532-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian dla-3532 : openssh-client - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3532 advisory. - ----------------------------------------------------------------------- Debian LTS Advisory DLA-3532-1 [email protected] https://www.debian.org/lts/security/...

DLA-3532-1 openssh - security update

Bulletin has no description...

CVE-2023-38408 affecting package openssh 8.9p1-2

CVE-2023-38408 affecting package openssh 8.9p1-2. A patched version of the package is available...

Oracle Linux 7 : openssh (ELSA-2023-12711)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-12711 advisory. 7.4p1-23.0.1fips - Change Epoch from 1 to 10 - Enable fips KDF POST Orabug: 32461750 - Disable diffie-hellman-group-exchange-sha256 KEX FIPS method Orabug:...

Oracle Linux 6 : openssh (ELSA-2023-4428)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4428 advisory. - Fix for CVE-2016-6210 incomplete fix Orabug: 29375502CVE-2016-6210 Tenable has extracted the preceding description block directly from the Oracle Lin...

Amazon Linux 2023 : openssh, openssh-clients, openssh-keycat (ALAS2023-2023-273)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-273 advisory. The PKCS11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if the target user's ssh-agent is forwarded to an...

Amazon Linux 2 : openssh (ALAS-2023-2202)

The version of openssh installed on the remote host is prior to 7.4p1-22. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2202 advisory. An issue was discovered in OpenSSH 7.4 on Amazon Linux 2 and Amazon Linux 1. The fix for CVE-2019-6111 only covered cases where an...