High ELSA-2023-4412 1 CVE

Important: openssh security update (Oracle Linux 9)

Published Aug 2, 2023 · Updated Aug 2, 2023

Ecosystem: Oracle Linux

Summary

[8.7p1-30]
- Avoid remote code execution in ssh-agent PKCS#11 support
Resolves: CVE-2023-38408

Fixed packages 6

Release	Package	Fixed in
Oracle Linux · 9	openssh	0:8.7p1-30.el9_2
Oracle Linux · 9	openssh-askpass	0:8.7p1-30.el9_2
Oracle Linux · 9	openssh-clients	0:8.7p1-30.el9_2
Oracle Linux · 9	openssh-keycat	0:8.7p1-30.el9_2
Oracle Linux · 9	openssh-server	0:8.7p1-30.el9_2
Oracle Linux · 9	pam_ssh_agent_auth	0:0.10.4-5.30.el9_2

Vulnerabilities 1

Critical 9.8

CVE-2023-38408 Public exploit EPSS 80%

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remo…

openssh openssh openssh-ssh1 openssh Debian Ubuntu Azure Linux Alpine Wolfi

Jul 20, 2023