High ELSA-2023-4419 1 CVE

Important: openssh security update (Oracle Linux 8)

Published Aug 2, 2023 · Updated Aug 2, 2023

Ecosystem: Oracle Linux

Summary

[8.0p1-19]
- Release bump

[8.0p1-18]
- Avoid remote code execution in ssh-agent PKCS#11 support
Resolves: CVE-2023-38408

Fixed packages 8

Release	Package	Fixed in
Oracle Linux · 8	openssh	0:8.0p1-19.el8_8
Oracle Linux · 8	openssh-askpass	0:8.0p1-19.el8_8
Oracle Linux · 8	openssh-cavs	0:8.0p1-19.el8_8
Oracle Linux · 8	openssh-clients	0:8.0p1-19.el8_8
Oracle Linux · 8	openssh-keycat	0:8.0p1-19.el8_8
Oracle Linux · 8	openssh-ldap	0:8.0p1-19.el8_8
Oracle Linux · 8	openssh-server	0:8.0p1-19.el8_8
Oracle Linux · 8	pam_ssh_agent_auth	0:0.10.3-7.19.el8_8

Vulnerabilities 1

Critical 9.8

CVE-2023-38408 Public exploit EPSS 80%

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remo…

openssh openssh openssh-ssh1 openssh Debian Ubuntu Azure Linux Alpine Wolfi

Jul 20, 2023