650 matches found
CVE-2023-38408
OpenSSH Vulnerability - CVE-2023-38408 📚 Introduction A vulnerability was found in OpenSSH before 9.3p2 version. The PKCS11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system...
lxd_root
Linux Privilege Escalation via LXD Overview Members of the local lxd group on Linux systems have numerous routes to escalate their privileges to root. This repository contains examples of fully automated local root exploits. A detailed explanation of the vulnerability and an exploit walk-through ...
CVE-2023-38408
Reference / info https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt...
sshkey-grab
sshkey-grab This script uses a bug in ssh-agent that allows it to pull the last key added to the agent. This may allow the ability to recover a key that has been removed from ssh-agent via ssh-add -t, -d, or -D, provided that the ssh-agent was not terminated and a new key has not been added since...
CVE-2026-128088
A flaw was found in russh. In the Secure Shell SSH agent implementation, a signature request made before the agent is locked can still be completed after the lock is engaged because the agent fails to revalidate its lock status following user confirmation. A connected peer or remote server using...
PKCS11SSHAgent
SRO PKCS11 – SSH Agent CNG Sovereign unification PKCS11 + SSH-agent + Pageant + CNG/Smartcard A single Windows executable that unifies four traditionally separate functions: Full PKCS11 module Firefox, OpenSC, ssh -I SSH agent compatible with OpenSSH/Git/VS/WSL Pageant server compatible with...
CVE-2026-128087
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From version 0.55.0 until version 0.65.1, the initial key exchange invokes client::Handler::kexdone with the raw shared secret before checkserverkey accepts the server host key or certificate. A...
CVE-2026-128088
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to version 0.65.1, trysign captures an Arc before awaiting Agent::confirm and does not revalidate the shared lock state or key presence after the await. This is a distinct residual defect in th...
CVE-2026-128088
The russh Rust SSH library (prior to version 0.65.1 ) is vulnerable to a TOCTOU (Time-of-check Time-of-use) race condition in its SSH agent protocol implementation. The try_sign() function captures a private key but fails to revalidate the shared lock state after awaiting the asynchronous Agent::...
CVE-2026-128088 russh try_sign: asynchronous confirmation can sign after agent lock
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to version 0.65.1, trysign captures an Arc before awaiting Agent::confirm and does not revalidate the shared lock state or key presence after the await. This is a distinct residual defect in th...
CVE-2023-38408
OpenSSH Vulnerability - CVE-2023-38408 📚 Introduction A vulnerability was found in OpenSSH before 9.3p2 version. The PKCS11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system...
vault-conductor
🗝️ vault-conductor An SSH Agent that provides SSH keys stored in Bitwarden Secret Manager as secrets. Supports SSH authentication and Git commit signing. Demo Features It implements the SSH Agent Protocol as a Unix domain socket server, acting as a secure bridge between your SSH clients and...
cve-2023-38408
CVE-2023-38408: Understanding and Simulating a Real-World SSH-Agent Vulnerability Table of Contents 1. Introduction 2. Background Concepts 3. The CVE-2023-38408 Vulnerability 4. Practical Simulation and Testing 5. Technical Analysis 6. Fix and Mitigation 7. Conclusion 1. Introduction Purpose of...
Security Bulletin: IBM Guardium Data Protection — Edge Cluster is affected by multiple vulnerabilities
Summary IBM Guardium Data Protection — Edge Cluster has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2025-22869 DESCRIPTION: SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchan...
CVE-2026-116775
A flaw was found in pageant. A remote malicious server can trigger a Denial of Service DoS on a client system when SSH agent forwarding is bridged to a raw Pageant stream. By transmitting an excessively large frame length prefix, an attacker can force the client to buffer data without proper boun...
russh: russh: Denial of Service via resource exhaustion in SSH agent
A flaw was found in russh. When processing key addition requests containing lifetime constraints, the Secure Shell SSH agent server spawns a separate long-lived task for repeated constraint records and fails to roll back tasks if subsequent parsing fails. An attacker capable of communicating with...
russh: russh: Denial of Service via uncontrolled memory consumption in SSH agent
A flaw was found in russh. This vulnerability can lead to a Denial of Service DoS due to unbounded memory consumption in the SSH agent service. A local process or a remote user with access to a forwarded agent socket can repeatedly submit keys containing an excessive number of confirmation...
russh: russh: Unauthorized key signing via SSH agent confirmation bypass
A flaw was found in russh. When processing signing requests for SSH keys configured to require explicit confirmation, the SSH agent server component fails to invoke the confirmation check and automatically returns success. A local process or remote user with access to the forwarded SSH agent sock...
