Fluid Attacks Database

Description

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.16	openssh	>=8.9 <9.0_p1-r3	9.0_p1-r3
debian 13	openssh	>=0 <1:9.3p1-1	1:9.3p1-1
alpine v3.17	openssh	>=8.9 <9.1_p1-r3	9.1_p1-r3
debian 12	openssh	=1:9.2p1-2 \|\| =1:9.2p1-2+deb12u1 \|\| >=0 <1:9.2p1-2+deb12u2	1:9.2p1-2+deb12u2
debian 14	openssh	>=0 <1:9.3p1-1	1:9.3p1-1

Aliases

1. CVE-2023-285312. NVD-2023-285313. OSV-ALPINE-2023-285314. OSV-2023-285315. OSV-DEBIAN-2023-285316. SECURITY-CVE-2023-285317. SECURITY-TRACKER-CVE-2023-28531

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.