An update of the openssh package has been released.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 887eb570-27d3-11ee-adba-c80aa9043978 advisory.

  - The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path,     leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in     /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an     incomplete fix for CVE-2016-10009. (CVE-2023-38408)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:2940-1 advisory.

  - The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path,     leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in     /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an     incomplete fix for CVE-2016-10009. (CVE-2023-38408)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2946-1 advisory.

  - The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path,     leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in     /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an     incomplete fix for CVE-2016-10009. (CVE-2023-38408)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4383 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: Remote code execution in ssh-agent PKCS#11 support (CVE-2023-38408)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4419 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: Remote code execution in ssh-agent PKCS#11 support (CVE-2023-38408)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4413 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: Remote code execution in ssh-agent PKCS#11 support (CVE-2023-38408)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:4412 advisory.

  - The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path,     leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in     /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an     incomplete fix for CVE-2016-10009. (CVE-2023-38408)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-4419 advisory.

    [8.0p1-19]
    - Release bump

    [8.0p1-18]
    - Avoid remote code execution in ssh-agent PKCS#11 support       Resolves: CVE-2023-38408

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-4412 advisory.

    [8.7p1-30]
    - Avoid remote code execution in ssh-agent PKCS#11 support       Resolves: CVE-2023-38408

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-12711 advisory.

    [7.4p1-23.0.1_fips]
    - Change Epoch from 1 to 10
    - Enable fips KDF POST [Orabug: 32461750]
    - Disable diffie-hellman-group-exchange-sha256 KEX FIPS method [Orabug: 32461739]

    [7.4p1-23.0.1]
    - enlarge format buffer size for certificate serial       number so the log message can record any 64-bit integer without       truncation (openssh bz#3012) [Orabug: 30448895]

    [7.4p1-23 + 0.10.3-2]
    - Avoid remote code execution in ssh-agent PKCS#11 support       Resolves: CVE-2023-38408

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3532 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-3532-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     August 17, 2023                             https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : openssh     Version        : 1:7.9p1-10+deb10u3     CVE ID         : CVE-2023-38408     Debian Bug     : 1042460

    It was discovered that OpenSSH incorrectly handled loading certain     PKCS#11 providers. If a user forwarded their ssh-agent to an untrusted     system, a remote attacker could possibly use this issue to load     arbitrary libraries from the users system and execute arbitrary code.

    In addition to the above security issue, this update also fixed     another bug - bad interaction between the ssh_config ConnectTimeout     and ConnectionAttempts directives - connection attempts after the     first attempt were ignoring the requested timeout. More details about     this can be found at https://bugzilla.mindrot.org/show_bug.cgi?id=2918.

    For Debian 10 buster, this problem has been fixed in version     1:7.9p1-10+deb10u3.

    We recommend that you upgrade your openssh packages.

    For the detailed security status of openssh please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openssh

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of openssh installed on the remote host is prior to 7.4p1-22.80. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1802 advisory.

    The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path,     leading to remote code execution if the target user's ssh-agent is forwarded to an attacker-controlled     system (the code in /usr/lib is not necessarily safe for loading into ssh-agent). Exploitation can also be     prevented by starting ssh-agent with an empty PKCS#11/FIDO allowlist (ssh-agent -P '') or by configuring     an allowlist that contains only specific provider libraries. NOTE: this issue exists because of an     incomplete fix for CVE-2016-10009. (CVE-2023-38408)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.7.0.6. It is, therefore, affected by a vulnerability as referenced in the NXSA-AOS-6.7.0.6 advisory.

  - The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path,     leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in     /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an     incomplete fix for CVE-2016-10009. (CVE-2023-38408)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
204263	Photon OS 4.0: Openssh PHSA-2023-4.0-0440	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	critical
178713	FreeBSD : OpenSSH -- remote code execution via a forwarded agent socket (887eb570-27d3-11ee-adba-c80aa9043978)	Nessus	FreeBSD Local Security Checks	7/21/2023	8/1/2023	critical
178757	SUSE SLES12 Security Update : openssh (SUSE-SU-2023:2940-1)	Nessus	SuSE Local Security Checks	7/25/2023	12/22/2023	critical
178760	SUSE SLES15 Security Update : openssh (SUSE-SU-2023:2946-1)	Nessus	SuSE Local Security Checks	7/25/2023	12/22/2023	critical
179150	RHEL 8 : openssh (RHSA-2023:4383)	Nessus	Red Hat Local Security Checks	8/1/2023	11/7/2024	high
179179	RHEL 8 : openssh (RHSA-2023:4419)	Nessus	Red Hat Local Security Checks	8/1/2023	11/7/2024	high
179181	RHEL 8 : openssh (RHSA-2023:4413)	Nessus	Red Hat Local Security Checks	8/1/2023	11/7/2024	high
179221	AlmaLinux 9 : openssh (ALSA-2023:4412)	Nessus	Alma Linux Local Security Checks	8/2/2023	12/22/2023	critical
179236	Oracle Linux 8 : openssh (ELSA-2023-4419)	Nessus	Oracle Linux Local Security Checks	8/2/2023	10/23/2024	high
179237	Oracle Linux 9 : openssh (ELSA-2023-4412)	Nessus	Oracle Linux Local Security Checks	8/2/2023	10/23/2024	high
179841	Oracle Linux 7 : openssh (ELSA-2023-12711)	Nessus	Oracle Linux Local Security Checks	8/15/2023	10/23/2024	high
179924	Debian dla-3532 : openssh-client - security update	Nessus	Debian Local Security Checks	8/17/2023	1/22/2025	high
180064	Amazon Linux AMI : openssh (ALAS-2023-1802)	Nessus	Amazon Linux Local Security Checks	8/23/2023	12/11/2024	high
184396	Nutanix AOS : (NXSA-AOS-6.7.0.6)	Nessus	Misc.	11/4/2023	2/17/2025	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

high

high

high

critical

high

high

high

high

high

high