Skip to content
OpenAdvisories
Medium ELSA-2024-4457 1 CVE

Moderate: openssh security update (Oracle Linux 9)

Published Jul 10, 2024 · Updated Jul 10, 2024

Ecosystem: Oracle Linux

Summary

[8.7p1-38.0.2.4]
- Possible remote code execution due to a race condition (CVE-2024-6409)
Resolves: RHEL-45741

Fixed packages 6

ReleasePackageFixed in
Oracle Linux · 9 openssh 0:8.7p1-38.0.2.el9_4.4
Oracle Linux · 9 openssh-askpass 0:8.7p1-38.0.2.el9_4.4
Oracle Linux · 9 openssh-clients 0:8.7p1-38.0.2.el9_4.4
Oracle Linux · 9 openssh-keycat 0:8.7p1-38.0.2.el9_4.4
Oracle Linux · 9 openssh-server 0:8.7p1-38.0.2.el9_4.4
Oracle Linux · 9 pam_ssh_agent_auth 0:0.10.4-5.38.0.2.el9_4.4

Vulnerabilities 1

  • High 7.0
    CVE-2024-6409 EPSS 28%

    Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9

    A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls …

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux