RHEL 8 : openssh (RHSA-2023:4413)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4413 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary f...

Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: Remote code execution in ssh-agent PKCS11 support CVE-2023-38408 For more details...

RHEL 8 : openssh (RHSA-2023:4384)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4384 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary f...

USN-6242-2: OpenSSH vulnerability

USN-6242-1 fixed a vulnerability in OpenSSH. This update provides the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. Original advisory details: It was discovered that OpenSSH incorrectly handled loading certain PKCS11 providers. If a user forwarded their...

USN-6242-2 openssh vulnerability

USN-6242-1 fixed a vulnerability in OpenSSH. This update provides the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. Original advisory details: It was discovered that OpenSSH incorrectly handled loading certain PKCS11 providers. If a user forwarded their...

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

...

RHEL 9 : openssh (RHSA-2023:4329)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4329 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary f...

Fedora 37 : openssh (2023-79a18e1725)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-79a18e1725 advisory. Security fix for PUT CVEs HERE Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus ha...

SUSE SLES12 Security Update : openssh (SUSE-SU-2023:2940-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:2940-1 advisory. - CVE-2023-38408: Fixed a condition where specific libaries loaded via ssh-agent1's PKCS11 support could be abused to achieve remote code execution via...

SUSE SLED15: openssh / openssh-askpass-gnome / openssh-cavs / openssh-clients / etc (SUSE-SU-2023:2945-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2945-1 advisory. - CVE-2023-38408: Fixed a condition where specific libaries loaded via ssh-agent1's PKCS11 support could ...

SUSE SLES15 Security Update : openssh (SUSE-SU-2023:2947-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2947-1 advisory. - CVE-2023-38408: Fixed a condition where specific libaries loaded via ssh-agent1's PKCS11 support could be abused to achieve remote code...

SUSE SLES15 Security Update : openssh (SUSE-SU-2023:2946-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2946-1 advisory. This update for openssh fixes the following issue: - CVE-2023-38408: Fixed a condition where specific libaries loaded via ssh-agent1's PKCS1...

Ubuntu: Security Advisory (USN-6242-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6242-1: OpenSSH vulnerability

It was discovered that OpenSSH incorrectly handled loading certain PKCS11 providers. If a user forwarded their ssh-agent to an untrusted system, a remote attacker could possibly use this issue to load arbitrary libraries from the user's system and execute arbitrary code...

USN-6242-1 openssh vulnerability

It was discovered that OpenSSH incorrectly handled loading certain PKCS11 providers. If a user forwarded their ssh-agent to an untrusted system, a remote attacker could possibly use this issue to load arbitrary libraries from the user's system and execute arbitrary code...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : OpenSSH vulnerability (USN-6242-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6242-1 advisory. It was discovered that OpenSSH incorrectly handled loading certain PKCS11 providers. If a user forwarded their ssh-agent to an untrusted syste...

SUSE-SU-2023:2940-1 Security update for openssh

This update for openssh fixes the following issues: - CVE-2023-38408: Fixed a condition where specific libaries loaded via ssh-agent1's PKCS11 support could be abused to achieve remote code execution via a forwarded agent socket if those libraries were present on the victim's system and if the...

FreeBSD : OpenSSH -- remote code execution via a forwarded agent socket (887eb570-27d3-11ee-adba-c80aa9043978)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 887eb570-27d3-11ee-adba-c80aa9043978 advisory. - The PKCS11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path...

Remote Code Execution (RCE)

openssh is vulnerable to Remote Code Execution RCE. The vulnerability exists due to the insufficient trustworthy search path in the PKCS11 feature in ssh-agent of the library, allowing an attacker to inject and execute malicious code if an agent is forwarded to an attacker-controlled system. NOTE...

CVE-2023-38408

A vulnerability was found in OpenSSH. The PKCS11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system the code in /usr/lib is not necessarily safe for loading into ssh-agent...