{"id":"CVE-2023-25136","aliases":["ALSA-2023:2645","BELL-CVE-2023-25136","DEBIAN-CVE-2023-25136","EUVD-2023-29115","GHSA-w62j-g234-3f6f","JLSEC-2026-66","OESA-2023-1063","OESA-2023-1064","RHSA-2023:2645","UBUNTU-CVE-2023-25136"],"status":"published","title":"OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms...","description":"OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states \"remote code execution is theoretically possible.\"","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.89792,"percentile":0.99792,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-415"],"published":"2023-02-03T00:00:00Z","modified":"2026-10-29T11:30:55Z","exploits":[{"source":"pocgithub","id":"Business1sg00d/CVE-2023-25136","title":"Business1sg00d/CVE-2023-25136","date":"2023-09-04","url":"https://github.com/Business1sg00d/CVE-2023-25136"},{"source":"pocgithub","id":"Christbowel/CVE-2023-25136","title":"Christbowel/CVE-2023-25136","date":"2023-02-22","url":"https://github.com/Christbowel/CVE-2023-25136"},{"source":"pocgithub","id":"H4K6/CVE-2023-25136","title":"H4K6/CVE-2023-25136","date":"2023-06-30","url":"https://github.com/H4K6/CVE-2023-25136"},{"source":"pocgithub","id":"Lane0218/CVE-2023-25136-PoC","title":"Lane0218/CVE-2023-25136-PoC","date":"2025-11-18","url":"https://github.com/Lane0218/CVE-2023-25136-PoC"},{"source":"pocgithub","id":"adhikara13/CVE-2023-25136","title":"adhikara13/CVE-2023-25136","date":"2023-04-18","url":"https://github.com/adhikara13/CVE-2023-25136"},{"source":"pocgithub","id":"axylisdead/CVE-2023-25136_POC","title":"axylisdead/CVE-2023-25136_POC","date":"2023-06-03","url":"https://github.com/axylisdead/CVE-2023-25136_POC"},{"source":"pocgithub","id":"jfrog/jfrog-CVE-2023-25136-OpenSSH_Double-Free","title":"jfrog/jfrog-CVE-2023-25136-OpenSSH_Double-Free","date":"2023-02-07","url":"https://github.com/jfrog/jfrog-CVE-2023-25136-OpenSSH_Double-Free"},{"source":"pocgithub","id":"malvika-thakur/CVE-2023-25136","title":"malvika-thakur/CVE-2023-25136","date":"2023-09-21","url":"https://github.com/malvika-thakur/CVE-2023-25136"},{"source":"pocgithub","id":"mrmtwoj/CVE-2023-25136","title":"mrmtwoj/CVE-2023-25136","date":"2025-01-16","url":"https://github.com/mrmtwoj/CVE-2023-25136"},{"source":"pocgithub","id":"nhakobyan685/CVE-2023-25136","title":"nhakobyan685/CVE-2023-25136","date":"2023-04-28","url":"https://github.com/nhakobyan685/CVE-2023-25136"},{"source":"pocgithub","id":"ticofookfook/CVE-2023-25136","title":"ticofookfook/CVE-2023-25136","date":"2023-02-14","url":"https://github.com/ticofookfook/CVE-2023-25136"}],"fixes":[{"ecosystem":"AlmaLinux:9","package":"openssh","fixed_in":["8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"openssh-askpass","fixed_in":["8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"openssh-clients","fixed_in":["8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"openssh-keycat","fixed_in":["8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"openssh-server","fixed_in":["8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"pam_ssh_agent_auth","fixed_in":["0.10.4-5.29.el9_2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openssh","fixed_in":["9.1_p1-r7"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openssh","fixed_in":["9.1_p1-r7"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openssh","fixed_in":["1:9.2p1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssh","fixed_in":["1:9.2p1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssh","fixed_in":["1:9.2p1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenSSH_jll","fixed_in":["9.1.0+0"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"openssh","fixed_in":["8.8p1-16.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"openssh","fixed_in":["8.8p1-18.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-askpass","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-askpass-debuginfo","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-clients-debuginfo","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-debuginfo","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-debugsource","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-keycat-debuginfo","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-server-debuginfo","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-sk-dummy-debuginfo","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam_ssh_agent_auth","fixed_in":["0:0.10.4-5.29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam_ssh_agent_auth-debuginfo","fixed_in":["0:0.10.4-5.29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-askpass-debuginfo","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-clients","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-clients-debuginfo","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-debuginfo","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-debugsource","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-keycat","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-keycat-debuginfo","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-server","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-server-debuginfo","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-sk-dummy-debuginfo","fixed_in":["0:8.7p1-29.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"pam_ssh_agent_auth-debuginfo","fixed_in":["0:0.10.4-5.29.el9_2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-5.29.el9_2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1_p1-r3"},{"fixed":"9.1_p1-r7"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1_p1-r3"},{"fixed":"9.1_p1-r7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.2p1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.2p1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.2p1-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"OpenSSH_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.9.0+0"},{"fixed":"9.1.0+0"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8p1-16.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8p1-18.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-sk-dummy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-5.29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-5.29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-sk-dummy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-29.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-5.29.el9_2"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"netapp","product":"500f_firmware"},{"vendor":"netapp","product":"a250_firmware"},{"vendor":"netapp","product":"c250_firmware"},{"vendor":"netapp","product":"ontap_select_deploy_administration_utility"},{"vendor":"openbsd","product":"openssh"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig","tags":["x_transferred","Patch","Vendor Advisory","web","article"]},{"url":"https://www.openwall.com/lists/oss-security/2023/02/02/2","tags":["x_transferred","Exploit","Mailing List","Third Party Advisory","web","article","report"]},{"url":"https://bugzilla.mindrot.org/show_bug.cgi?id=3522","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web","article"]},{"url":"https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946","tags":["x_transferred","Patch","Third Party Advisory","fix","web","article"]},{"url":"https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/","tags":["x_transferred","Exploit","Third Party Advisory","article","web","report"]},{"url":"https://news.ycombinator.com/item?id=34711565","tags":["x_transferred","Issue Tracking","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/02/13/1","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/02/22/1","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/02/22/2","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/02/23/3","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/03/06/1","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/03/09/2","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230309-0003/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202307-01","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25136","tags":["advisory"]},{"url":"https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3"},{"url":"https://security.netapp.com/advisory/ntap-20230309-0003"},{"url":"https://github.com/advisories/GHSA-w62j-g234-3f6f"},{"url":"https://access.redhat.com/errata/RHSA-2023:2645","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25136","tags":["report"]},{"url":"https://bugzilla.redhat.com/2167636","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-2645.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-25136","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25136.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-25136","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1063","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1064","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167636","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2645.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25136","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2023-25136","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/02/13/1","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-25136","description":"OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states \"remote code execution is theoretically possible.\"","status":"published","published":"2023-02-03T00:00:00Z","modified":"2026-10-14T22:32:04.906Z","cwes":["CWE-415"],"updated_at":"2026-11-02T14:35:19.959682Z"}],"euvd":[{"id":"EUVD-2023-29115","description":"OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states \"remote code execution is theoretically possible.\"","status":"published","published":"2023-02-03T00:00:00Z","modified":"2026-10-14T22:32:04Z","updated_at":"2026-11-02T17:27:11.707191Z"}],"ghsa":[{"id":"GHSA-w62j-g234-3f6f","title":"OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms...","description":"OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be triggered by an unauthenticated attacker in the default configuration; however, the vulnerability discoverer reports that \"exploiting this vulnerability will not be easy.\"","status":"published","published":"2023-02-03T06:30:23Z","modified":"2026-10-15T00:31:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T15:13:29.914076Z"}],"nvd":[{"id":"CVE-2023-25136","description":"OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states \"remote code execution is theoretically possible.\"","status":"published","published":"2023-02-03T06:15:09.35Z","modified":"2026-10-14T23:17:15.01Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:07:46.064662Z"}],"osv":[{"id":"BELL-CVE-2023-25136","status":"published","published":"2023-10-18T13:45:20.522068Z","modified":"2026-01-26T09:33:16.169108Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"DEBIAN-CVE-2023-25136","description":"OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states \"remote code execution is theoretically possible.\"","status":"published","published":"2023-02-03T06:15:09.35Z","modified":"2026-10-26T18:01:37.169158696Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"JLSEC-2026-66","description":"OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during `options.kex_algorithms` handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states \"remote code execution is theoretically possible.\"","status":"published","published":"2026-04-09T21:32:46.691Z","modified":"2026-07-25T18:24:44.148557182Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"OESA-2023-1063","title":"openssh security update","description":"OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \\ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \\ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \\ capabilities, several authentication methods, and sophisticated configuration options.\r\n\r\nSecurity Fix(es):\r\n\r\nOpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be triggered by an unauthenticated attacker in the default configuration. One third-party report states \u0026quot;remote code execution is theoretically possible.\u0026quot;(CVE-2023-25136)","status":"published","published":"2023-02-10T11:05:32Z","modified":"2026-08-18T01:17:30.116178872Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1064","title":"openssh security update","description":"OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \\ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \\ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \\ capabilities, several authentication methods, and sophisticated configuration options.\r\n\r\nSecurity Fix(es):\r\n\r\nOpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be triggered by an unauthenticated attacker in the default configuration. One third-party report states \u0026quot;remote code execution is theoretically possible.\u0026quot;(CVE-2023-25136)","status":"published","published":"2023-02-10T11:05:32Z","modified":"2026-08-18T01:17:30.071674434Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2023:2645","title":"Red Hat Security Advisory: openssh security update","status":"published","published":"2024-09-16T11:38:31Z","modified":"2026-06-26T12:21:18.601933847Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"UBUNTU-CVE-2023-25136","description":"OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states \"remote code execution is theoretically possible.\"","status":"withdrawn","published":"2023-02-03T06:15:00Z","modified":"2025-10-30T05:06:42Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"ALSA-2023:2645","title":"Moderate: openssh security update","description":"OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.\n\nSecurity Fix(es):\n\n* openssh: the functions order_hostkeyalgs() and list_hostkey_types() leads to double-free vulnerability (CVE-2023-25136)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-29T11:30:55.416498366Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CVE-2023-25136","description":"OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states \"remote code execution is theoretically possible.\"","status":"published","published":"2023-02-03T00:00:00Z","modified":"2026-10-28T10:31:58.991712964Z","updated_at":"2026-11-02T15:44:30.709518Z"}]}}