Red Hat Security AdvisoryRHSA-2023:4382
openssh security update
Released 2023-08-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) openssh-7.4p1-23.el7_9, openssh-askpass-7.4p1-23.el7_9, openssh-clients-7.4p1-23.el7_9 +2
- Red Hat Enterprise Linux Client Optional (v. 7) openssh-cavs-7.4p1-23.el7_9, openssh-ldap-7.4p1-23.el7_9, openssh-server-sysvinit-7.4p1-23.el7_9 +1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssh-askpass-7.4p1-23.el7_9, openssh-cavs-7.4p1-23.el7_9, openssh-ldap-7.4p1-23.el7_9 +2
- Red Hat Enterprise Linux Server (v. 7) openssh-7.4p1-23.el7_9, openssh-askpass-7.4p1-23.el7_9, openssh-clients-7.4p1-23.el7_9 +2
- Red Hat Enterprise Linux Server Optional (v. 7) openssh-cavs-7.4p1-23.el7_9, openssh-ldap-7.4p1-23.el7_9, openssh-server-sysvinit-7.4p1-23.el7_9 +2
- Red Hat Enterprise Linux Workstation (v. 7) openssh-7.4p1-23.el7_9, openssh-askpass-7.4p1-23.el7_9, openssh-clients-7.4p1-23.el7_9 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssh-cavs-7.4p1-23.el7_9, openssh-ldap-7.4p1-23.el7_9, openssh-server-sysvinit-7.4p1-23.el7_9 +1
Fixes 1 record
Priority CRITICAL 89
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.797 · Published 2023-07-20 · Fixed CWE-428
