Fluid Attacks Database

Description

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	openssh	=1:9.2p1-2 \|\| >=0 <1:9.2p1-2+deb12u1	1:9.2p1-2+deb12u1
alpine v3.16	openssh	>=0 <9.0_p1-r4	9.0_p1-r4
alpine v3.17	openssh	>=0 <9.1_p1-r4	9.1_p1-r4
debian 11	openssh	=1:8.4p1-5 \|\| =1:8.4p1-5+deb11u1 \|\| >=0 <1:8.4p1-5+deb11u2	1:8.4p1-5+deb11u2
debian 13	openssh	>=0 <1:9.3p2-1	1:9.3p2-1
debian 14	openssh	>=0 <1:9.3p2-1	1:9.3p2-1
rpm rhel7	openssh	<0:7.4p1-23.el7_9	0:7.4p1-23.el7_9
rpm rhel8.6	openssh	<0:8.0p1-15.el8_6	0:8.0p1-15.el8_6
rpm rhel9	openssh	<0:8.7p1-30.el9_2	0:8.7p1-30.el9_2
rpm rhel9.0	openssh	<0:8.7p1-11.el9_0	0:8.7p1-11.el9_0

1-10 of 12

Aliases

1. CVE-2023-384082. NVD-2023-384083. OSV-DEBIAN-2023-384084. OSV-2023-384085. OSV-ALPINE-2023-384086. SECURITY-TRACKER-CVE-2023-384087. SECURITY-CVE-2023-38408

References

1. https://vulncheck.com/cve/CVE-2023-384082. https://github.com/kali-mx/CVE-2023-38408

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.