Every CVE Search/ Get API key

CVE-2023-28531

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop...

9.8 CriticalFix available

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.99%Up 2.9 points since Mar 17, 2023
90%50%10%1%

What each source reports

NVD Score used 9.8

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

Record
CVE-2023-28531
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-02
CVE List No score

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

Record
CVE-2023-28531
Weakness
CWE-284
Updated
2026-11-02
EUVDEUVD-2023-32201 No score

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

Record
EUVD-2023-32201
Updated
2026-11-02
GitHub AdvisoriesGHSA-j839-ff8c-f62x 9.8

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop...

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints.

Record
GHSA-j839-ff8c-f62x
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-02
OSVALPINE-CVE-2023-28531 9.8

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

Record
ALPINE-CVE-2023-28531
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-25662 9.8

CVE-2023-28531 affecting package openssh for versions less than 8.9p1-5

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

Record
AZL-25662
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVBELL-CVE-2023-28531 9.8

CVE-2023-28531 does not affect BellSoft software

Record
BELL-CVE-2023-28531
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

Record
CVE-2023-28531
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-28531 9.8

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

Record
DEBIAN-CVE-2023-28531
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVJLSEC-2026-67 9.8

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

Record
JLSEC-2026-67
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-28531 9.8

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

Record
UBUNTU-CVE-2023-28531
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUSN-6560-1 No score

openssh vulnerabilities

Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension negotiation messages could be truncated, possibly leading to certain algorithms and features being downgraded. This issue is known as the Terrapin attack. This update adds protocol extensions to mitigate this issue. (CVE-2023-48795)

Luci Stanescu discovered that OpenSSH incorrectly added destination constraints when smartcard keys were added to ssh-agent, contrary to expectations. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-28531)

Record
USN-6560-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssh
Alpine:v3.16
 8.9 up to 9.0_p1-r3
9.0_p1-r3
openssh
Alpine:v3.17
 8.9 up to 9.1_p1-r3
9.1_p1-r3
openssh
Azure Linux:2
 before 8.9p1-5
8.9p1-5
openssh
Debian:12
 before 1:9.2p1-2+deb12u2, plus listed versions
1:9.2p1-21:9.2p1-2+deb12u1
1:9.2p1-2+deb12u2
openssh
Debian:13
 before 1:9.3p1-1
1:9.3p1-1
openssh
Debian:14
 before 1:9.3p1-1
1:9.3p1-1
OpenSSH_jll
Julia
 8.9.0+0 up to 9.3.2+0
9.3.2+0
openssh
Ubuntu:22.04:LTS
 before 1:8.9p1-3ubuntu0.5, plus listed versions
1:8.4p1-6ubuntu21:8.7p1-21:8.7p1-2build11:8.7p1-41:8.8p1-1
Show 4 moreShow less
1:8.9p1-31:8.9p1-3ubuntu0.11:8.9p1-3ubuntu0.31:8.9p1-3ubuntu0.4
1:8.9p1-3ubuntu0.5
openssh
Ubuntu:20.04:LTS
 before 1:8.2p1-4ubuntu0.10, plus listed versions
1:8.0p1-6build11:8.1p1-11:8.1p1-51:8.2p1-41:8.2p1-4ubuntu0.1
Show 7 moreShow less
1:8.2p1-4ubuntu0.21:8.2p1-4ubuntu0.31:8.2p1-4ubuntu0.41:8.2p1-4ubuntu0.51:8.2p1-4ubuntu0.71:8.2p1-4ubuntu0.81:8.2p1-4ubuntu0.9
1:8.2p1-4ubuntu0.10

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-28531 is a critical vulnerability (CVSS 9.8) in Openbsd Openssh, published March 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.99%, the 87th percentile. Fixed in openssh 9.0_p1-r3.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open