Skip to content
OpenAdvisories
Medium ALSA-2024:4457 1 CVE

Moderate: openssh security update

Published Jul 10, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es):

* openssh: Possible remote code execution due to a race condition in signal handling affecting AlmaLinux(CVE-2024-6409)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 6

ReleasePackageFixed in
AlmaLinux · 9 openssh 8.7p1-38.el9_4.4
AlmaLinux · 9 openssh-askpass 8.7p1-38.el9_4.4
AlmaLinux · 9 openssh-clients 8.7p1-38.el9_4.4
AlmaLinux · 9 openssh-keycat 8.7p1-38.el9_4.4
AlmaLinux · 9 openssh-server 8.7p1-38.el9_4.4
AlmaLinux · 9 pam_ssh_agent_auth 0.10.4-5.38.el9_4.4

Vulnerabilities 1

  • High 7.0
    CVE-2024-6409 EPSS 28%

    Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9

    A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls …

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-6409
  • report
    https://bugzilla.redhat.com/2295085
  • advisory
    https://errata.almalinux.org/9/ALSA-2024-4457.html