Improper Authentication

🗓️ 30 Jan 2024 17:07:03Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 40 Views

OpenSSH vulnerability due to incomplete destination constraints with PKCS#11 token

Reporter	Title	Published	Views	Family All 138
IBM Security Bulletins	Security Bulletin: AIX is vulnerable to a machine-in-the-middle attack (CVE-2023-48795), arbitrary command execution (CVE-2023-51385), and information disclosure (CVE-2023-51384) due to OpenSSH	14 Mar 202420:09	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access	12 Jan 202623:03	–	ibm
ATTACKERKB	CVE-2023-51384	18 Dec 202319:15	–	attackerkb
AlpineLinux	CVE-2023-51384	18 Dec 202300:00	–	alpinelinux
BDU FSTEC	The vulnerability of the SSH protocol lies in its ability to adjust packet sequence numbers during connection negotiation and to delete any number of SSH protocol messages. This allows attackers to bypass integrity checks, disable existing security functions, and gain unauthorized access to protected information.	19 Dec 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the OpenSSH cryptographic protection lies in the possibility of introducing or modifying arguments, allowing attackers to execute arbitrary commands.	21 Dec 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the ssh-agent agent in the OpenSSH encryption protection mechanism allows attackers to disclose the protected information.	21 Dec 202300:00	–	bdu_fstec
CBLMariner	CVE-2023-51384 affecting package openssh for versions less than 8.9p1-3	4 Jan 202419:54	–	cbl_mariner
CBLMariner	CVE-2023-51384 affecting package openssh for versions less than 9.7p1-1	17 May 202421:38	–	cbl_mariner
Cloud Foundry	USN-6565-1: OpenSSH vulnerabilities \| Cloud Foundry	29 Feb 202400:00	–	cloudfoundry

Vulners

Node

openbsd opensshMatch9.1_p1-r2os

AND

openbsd opensshMatch9.1_p1-r0os

AND

openbsd opensshMatch9.1_p1-r4os

AND

openbsd opensshMatch9.1_p1-r3os

AND

openbsd opensshMatch9.1_p1-r1os

AND

alpinelinux alpine_linuxMatch3.17

openbsd opensshMatch9.0_p1-r4os

AND

openbsd opensshMatch9.0_p1-r3os

AND

openbsd opensshMatch9.0_p1-r1os

AND

openbsd opensshMatch9.0_p1-r0os

AND

openbsd opensshMatch9.0_p1-r2os

AND

alpinelinux alpine_linuxMatch3.16

Source	Link
seclists	www.seclists.org/fulldisclosure/2024/Mar/21
secdb	www.secdb.alpinelinux.org/v3.17/main.yaml
debian	www.debian.org/security/2023/dsa-5586
github	www.github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b
security	www.security.netapp.com/advisory/ntap-20240105-0005/
support	www.support.apple.com/kb/HT214084
openssh	www.openssh.com/txt/release-9.6
openwall	www.openwall.com/lists/oss-security/2023/12/18/2

16 May 2024 23:06Current

7High risk

Vulners AI Score7

CVSS 3.15.5

EPSS0.00015