Critical RHSA-2023:4428 1 CVE

Red Hat Security Advisory: openssh security update

Published Sep 16, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 7

Release	Package	Fixed in
Red Hat · RHEL 6 ELS rhel_els:6	openssh	0:5.3p1-125.el6_10
Red Hat · RHEL 6 ELS rhel_els:6	openssh-askpass	0:5.3p1-125.el6_10
Red Hat · RHEL 6 ELS rhel_els:6	openssh-clients	0:5.3p1-125.el6_10
Red Hat · RHEL 6 ELS rhel_els:6	openssh-debuginfo	0:5.3p1-125.el6_10
Red Hat · RHEL 6 ELS rhel_els:6	openssh-ldap	0:5.3p1-125.el6_10
Red Hat · RHEL 6 ELS rhel_els:6	openssh-server	0:5.3p1-125.el6_10
Red Hat · RHEL 6 ELS rhel_els:6	pam_ssh_agent_auth	0:0.9.3-125.el6_10

Vulnerabilities 1

Critical 9.8

CVE-2023-38408 Public exploit EPSS 80%

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remo…

openssh openssh openssh-ssh1 openssh Debian Ubuntu Azure Linux Alpine Wolfi

Jul 20, 2023

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2224173
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4428.json
report
https://access.redhat.com/security/cve/CVE-2023-38408
advisory
https://www.cve.org/CVERecord?id=CVE-2023-38408
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-38408
article
https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt