Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
gentooGentoo FoundationGLSA-202307-01
HistoryJul 20, 2023 - 12:00 a.m.

OpenSSH: Remote Code Execution

2023-07-2000:00:00
Gentoo Foundation
security.gentoo.org
59
openssh
remote code execution
vulnerabilities
cve-2023-38408
upgrade
workaround

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.028 Low

EPSS

Percentile

90.7%

JSON

Background

OpenSSH is a free application suite consisting of server and clients that replace tools like telnet, rlogin, rcp and ftp with more secure versions offering additional functionality.

Description

Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details.

Impact

Please review the CVE identifiers referenced below for details.

Workaround

CVE-2023-38408 can be worked around by avoiding connecting to untrusted servers with an SSH agent.

Resolution

All OpenSSH users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-misc/openssh-9.3_p2"
OSVersionArchitecturePackageVersionFilename
Gentooanyallnet-misc/openssh< 9.3_p2UNKNOWN

Related

nessus 56
thn 2
alpinelinux 1
osv 11
veracode 1
nvd 2
cvelist 3
openvas 32
prion 3
cve 2
freebsd_advisory 3
cbl_mariner 6
freebsd 4
ubuntucve 3
debiancve 3
rosalinux 3
fedora 5
githubexploit 10
almalinux 3
f5 3
redhatcve 3
redos 2
wolfi 2
redhat 10
oraclelinux 6
cgr 2
ibm 3
debian 1
photon 1
cloudlinux 1
rocky 1
centos 1
ubuntu 3
cloudfoundry 2
qualysblog 2
slackware 1
aix 1
amazon 1
nessus
nessus
GLSA-202307-01 : OpenSSH: Remote Code Execution
2023-07-20 00:00:00
OpenSSH < 9.3 Multiple Vulnerabilities
2023-03-24 00:00:00
FreeBSD : FreeBSD -- ssh-add does not honor per-hop destination constraints (e31a8f8e-47bf-11ee-8e38-002590c1f29c)
2023-08-31 00:00:00
thn
thn
New OpenSSH Vulnerability Exposes Linux Systems to Remote Command Injection
2023-07-24 09:10:00
OpenSSH Releases Patch for New Pre-Auth Double Free Vulnerability
2023-02-06 09:55:00
alpinelinux
alpinelinux
CVE-2023-28531
2023-03-17 04:15:14
osv
osv
CVE-2023-28531
2023-03-17 04:15:14
Moderate: openssh security update
2023-05-09 00:00:00
CVE-2023-25136
2023-02-03 06:15:09
veracode
veracode
Privilege Escalation
2023-06-07 06:26:47
nvd
nvd
CVE-2023-28531
2023-03-17 04:15:14
CVE-2023-25136
2023-02-03 06:15:09
cvelist
cvelist
CVE-2023-28531
2023-03-17 00:00:00
CVE-2023-25136
2023-02-03 00:00:00
CVE-2023-38408
2023-07-20 00:00:00
openvas
openvas
Fedora: Security Advisory for openssh (FEDORA-2024-2aac54ebb7)
2024-02-12 00:00:00
Huawei EulerOS: Security Advisory for openssh (EulerOS-SA-2023-2479)
2023-07-31 00:00:00
Fedora: Security Advisory for openssh (FEDORA-2023-1176c8b10c)
2023-04-19 00:00:00
prion
prion
Code injection
2023-03-17 04:15:00
Double free
2023-02-03 06:15:00
Remote code execution
2023-07-20 03:15:00
cve
cve
CVE-2023-28531
2023-03-17 04:15:14
CVE-2023-25136
2023-02-03 06:15:09
freebsd_advisory
freebsd_advisory
FreeBSD-SA-23:05.openssh
2023-06-21 00:00:00
FreeBSD-SA-23:02.openssh
2023-02-16 00:00:00
FreeBSD-SA-23:08.ssh
2023-08-01 00:00:00
cbl_mariner
cbl_mariner
CVE-2023-28531 affecting package openssh 8.9p1-1
2023-06-27 21:25:25
CVE-2023-28531 affecting package openssh for versions less than 8.9p1-5
2024-06-28 17:07:09
CVE-2023-25136 affecting package openssh 8.9p1-5
2024-07-03 03:08:37
freebsd
freebsd
FreeBSD -- ssh-add does not honor per-hop destination constraints
2023-06-21 00:00:00
FreeBSD -- OpenSSH pre-authentication double free
2023-02-16 00:00:00
FreeBSD -- Potential remote code execution via ssh-agent forwarding
2023-08-01 00:00:00
ubuntucve
ubuntucve
CVE-2023-28531
2023-03-17 00:00:00
CVE-2023-25136
2023-02-03 00:00:00
CVE-2023-38408
2023-07-19 00:00:00
debiancve
debiancve
CVE-2023-28531
2023-03-17 04:15:14
CVE-2023-25136
2023-02-03 06:15:09
CVE-2023-38408
2023-07-20 03:15:10
rosalinux
rosalinux
Advisory ROSA-SA-2023-2127
2023-02-28 10:34:46
Advisory ROSA-SA-2023-2222
2023-08-29 11:57:56
Advisory ROSA-SA-2023-2229
2023-09-05 09:40:26
fedora
fedora
[SECURITY] Fedora 38 Update: openssh-9.0p1-15.fc38
2023-04-19 01:40:35
[SECURITY] Fedora 38 Update: openssh-9.0p1-19.fc38
2024-02-12 01:52:39
[SECURITY] Fedora 37 Update: openssh-8.8p1-10.fc37
2023-04-18 01:32:15
githubexploit
githubexploit
Exploit for Double Free in Openbsd Openssh
2023-09-04 19:28:43
Exploit for Double Free in Openbsd Openssh
2023-06-03 12:36:42
Exploit for Double Free in Openbsd Openssh
2023-06-30 09:34:36
almalinux
almalinux
Moderate: openssh security update
2023-05-09 00:00:00
Important: openssh security update
2023-08-01 00:00:00
Important: openssh security update
2023-08-01 00:00:00
f5
f5
K000132929 : OpenSSH vulnerability CVE-2023-25136
2023-03-10 00:00:00
K000133517 : OpenSSH vulnerability CVE-2023-28531
2023-04-14 00:00:00
K000135709 : OpenSSH vulnerability CVE-2023-38408
2023-08-02 00:00:00
redhatcve
redhatcve
CVE-2023-25136
2023-02-07 06:57:18
CVE-2023-28531
2023-03-17 12:43:10
CVE-2023-38408
2023-07-20 07:17:39
redos
redos
ROS-20230911-06
2023-09-11 00:00:00
ROS-20240212-01
2024-02-12 00:00:00
wolfi
wolfi
CVE-2023-25136 vulnerabilities
2024-07-03 09:08:38
CVE-2023-38408 vulnerabilities
2024-07-03 09:08:38
redhat
redhat
(RHSA-2023:2645) Moderate: openssh security update
2023-05-09 10:14:26
(RHSA-2023:4329) Important: openssh security update
2023-07-31 08:48:46
(RHSA-2023:4419) Important: openssh security update
2023-08-01 13:52:30
oraclelinux
oraclelinux
openssh security update
2023-05-17 00:00:00
openssh security update
2023-08-02 00:00:00
openssh security update
2023-08-02 00:00:00
cgr
cgr
CVE-2023-25136 vulnerabilities
2024-05-19 03:07:16
CVE-2023-38408 vulnerabilities
2024-05-19 03:07:16
ibm
ibm
Security Bulletin: Vulnerability in OpenSSH affects IBM Integrated Analytics System (Sailfish)[CVE-2023-38408]
2023-09-11 11:31:09
Security Bulletin: IBM Security Guardium is affected by an OpenSSH vulnerability (CVE-2023-38408)
2023-10-26 17:46:14
Security Bulletin: AIX is vulnerable to unauthorized file access and arbitrary code execution due to OpenSSH (CVE-2023-40371 and CVE-2023-38408)
2023-08-23 15:29:54
debian
debian
[SECURITY] [DLA 3532-1] openssh security update
2023-08-17 01:17:24
photon
photon
Critical Photon OS Security Update - PHSA-2023-4.0-0444
2023-08-02 00:00:00
cloudlinux
cloudlinux
openssh: Fix of CVE-2023-38408
2023-08-09 10:29:03
rocky
rocky
openssh security update
2023-08-08 12:34:30
centos
centos
openssh, pam_ssh_agent_auth security update
2024-01-12 19:29:35
ubuntu
ubuntu
OpenSSH vulnerability
2023-07-31 00:00:00
OpenSSH vulnerabilities
2023-12-19 00:00:00
OpenSSH vulnerability
2023-07-24 00:00:00
cloudfoundry
cloudfoundry
USN-6560-1: OpenSSH vulnerabilities | Cloud Foundry
2024-02-29 00:00:00
USN-6242-1: OpenSSH vulnerability | Cloud Foundry
2023-08-10 00:00:00
qualysblog
qualysblog
CVE-2023-38408: Remote Code Execution in OpenSSH’s forwarded ssh-agent
2023-07-19 15:53:27
CVE-2023-25136: Pre-Auth Double Free Vulnerability in OpenSSH Server 9.1
2023-02-03 19:37:22
slackware
slackware
[slackware-security] openssh
2023-07-19 20:41:55
aix
aix
AIX is vulnerable to unauthorized file access and arbitrary code execution due to OpenSSH
2023-08-23 08:36:37
amazon
amazon
Important: openssh
2023-08-03 18:09:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.028 Low

EPSS

Percentile

90.7%

JSON
Related for GLSA-202307-01
nessus56thn2alpinelinux1osv11veracode1nvd2cvelist3openvas32prion3cve2freebsd_advisory3cbl_mariner6freebsd4ubuntucve3debiancve3rosalinux3fedora5githubexploit10almalinux3f53redhatcve3redos2wolfi2redhat10oraclelinux6cgr2ibm3debian1photon1cloudlinux1rocky1centos1ubuntu3cloudfoundry2qualysblog2slackware1aix1amazon1