{"id":"CVE-2023-51384","aliases":["ALPINE-CVE-2023-51384","AZL-32205","AZL-35081","BELL-CVE-2023-51384","DEBIAN-CVE-2023-51384","EUVD-2023-56105","GHSA-44xq-r8h3-q4q6","JLSEC-2026-69","MGASA-2024-0010","ROOT-OS-ALPINE-318-CVE-2023-51384","UBUNTU-CVE-2023-51384","USN-6565-1"],"status":"published","title":"In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied....","description":"In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00426,"percentile":0.37112,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2023-12-18T00:00:00Z","modified":"2026-11-06T12:15:03Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"openssh","fixed_in":["9.0_p1-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openssh","fixed_in":["9.1_p1-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openssh","fixed_in":["9.6_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openssh","fixed_in":["9.6_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssh","fixed_in":["9.6_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssh","fixed_in":["9.6_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssh","fixed_in":["9.6_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssh","fixed_in":["9.6_p1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"openssh","fixed_in":["8.9p1-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"openssh","fixed_in":["9.7p1-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openssh","fixed_in":["9.1_p1-r7"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssh","fixed_in":["9.6_p1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openssh","fixed_in":["9.1_p1-r7"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssh","fixed_in":["9.6_p1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openssh","fixed_in":["1:9.2p1-2+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssh","fixed_in":["1:9.6p1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssh","fixed_in":["1:9.6p1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenSSH_jll","fixed_in":["9.9.1+0"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.18","package":"openssh","fixed_in":["9.3_p2-r20071","9.3_p2-r20073","9.3_p2-r20074","9.3_p2-r20072","9.3_p2-r30075","9.3_p2-r40076"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.18","package":"rootio-openssh","fixed_in":["9.3_p2-r20071","9.3_p2-r20073","9.3_p2-r20074","9.3_p2-r20072","9.3_p2-r30075","9.3_p2-r40076"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"openssh","fixed_in":["1:8.9p1-3ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"openssh","fixed_in":["1:9.6p1-3ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.9"},{"fixed":"9.0_p1-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.9"},{"fixed":"9.1_p1-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.9"},{"fixed":"9.6_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.9"},{"fixed":"9.6_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.9"},{"fixed":"9.6_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.9"},{"fixed":"9.6_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.9"},{"fixed":"9.6_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.9"},{"fixed":"9.6_p1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9p1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.7p1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1_p1-r3"},{"fixed":"9.1_p1-r7"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.3_p1-r7"},{"fixed":"9.6_p1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1_p1-r3"},{"fixed":"9.1_p1-r7"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.3_p1-r7"},{"fixed":"9.6_p1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.2p1-2+deb12u2"}]}],"versions":["1:9.2p1-2","1:9.2p1-2+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.6p1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.6p1-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"OpenSSH_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.9.0+0"},{"fixed":"9.9.1+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3p1-2.1.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:Alpine:3.18","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3_p2-r20071"},{"fixed":"9.3_p2-r20073"},{"fixed":"9.3_p2-r20074"},{"fixed":"9.3_p2-r20072"},{"fixed":"9.3_p2-r30075"},{"fixed":"9.3_p2-r40076"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.18","package":"rootio-openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3_p2-r20071"},{"fixed":"9.3_p2-r20073"},{"fixed":"9.3_p2-r20074"},{"fixed":"9.3_p2-r20072"},{"fixed":"9.3_p2-r30075"},{"fixed":"9.3_p2-r40076"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-8","1:7.5p1-9","1:7.5p1-9build1","1:7.5p1-10"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-11build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.9p1-3ubuntu0.6"}]}],"versions":["1:8.4p1-6ubuntu2","1:8.7p1-2","1:8.7p1-2build1","1:8.7p1-4","1:8.8p1-1","1:8.9p1-3","1:8.9p1-3ubuntu0.1","1:8.9p1-3ubuntu0.3","1:8.9p1-3ubuntu0.4","1:8.9p1-3ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-12","1:7.5p1-12build1","1:7.5p1-13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.6p1-3ubuntu1"}]}],"versions":["1:9.3p1-1ubuntu3","1:9.4p1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-14","1:7.5p1-15","1:7.5p1-15build1","1:7.5p1-16"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2p1-4ubuntu0.11"}]}],"versions":["1:8.0p1-6build1","1:8.1p1-1","1:8.1p1-5","1:8.2p1-4","1:8.2p1-4ubuntu0.1","1:8.2p1-4ubuntu0.2","1:8.2p1-4ubuntu0.3","1:8.2p1-4ubuntu0.4","1:8.2p1-4ubuntu0.5","1:8.2p1-4ubuntu0.7","1:8.2p1-4ubuntu0.8","1:8.2p1-4ubuntu0.9","1:8.2p1-4ubuntu0.10"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.9p1-3ubuntu0.6"}]}],"versions":["1:8.4p1-6ubuntu2","1:8.7p1-2","1:8.7p1-2build1","1:8.7p1-4","1:8.8p1-1","1:8.9p1-3","1:8.9p1-3ubuntu0.1","1:8.9p1-3ubuntu0.3","1:8.9p1-3ubuntu0.4","1:8.9p1-3ubuntu0.5"],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"openbsd","product":"openssh"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 tm mfp - gnu/linux subsystem"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://www.openssh.com/txt/release-9.6","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/12/18/2","tags":["x_transferred","Mailing List","Release Notes","web","report"]},{"url":"https://github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.debian.org/security/2023/dsa-5586","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240105-0005/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://support.apple.com/kb/HT214084","tags":["x_transferred","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Mar/21","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-794697.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-769027.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51384","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240105-0005"},{"url":"https://github.com/advisories/GHSA-44xq-r8h3-q4q6"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-51384","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-51384","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2023-11","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51384.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-51384","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0010.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32704","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6565-1","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2023/12/18/3","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2023/12/19/5","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2023/12/20/3","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31001","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/07/19/8","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2023/07/19/9","tags":["web"]},{"url":"https://www.openssh.com/txt/release-9.3p2","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-51384","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-51384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-41617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-51385","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-51384","description":"In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.","status":"published","published":"2023-12-18T00:00:00Z","modified":"2026-10-15T00:12:52.726Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:35:17.48054Z"}],"euvd":[{"id":"EUVD-2023-56105","description":"In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.","status":"published","published":"2023-12-18T00:00:00Z","modified":"2026-10-15T00:12:52Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:11.209168Z"}],"ghsa":[{"id":"GHSA-44xq-r8h3-q4q6","title":"In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied....","description":"In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.","status":"published","published":"2023-12-18T21:30:26Z","modified":"2026-10-15T03:33:12Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:13:30.561319Z"}],"nvd":[{"id":"CVE-2023-51384","description":"In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.","status":"published","published":"2023-12-18T19:15:08.72Z","modified":"2026-10-15T01:17:12.333Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:08:56.329586Z"}],"osv":[{"id":"ALPINE-CVE-2023-51384","description":"In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.","status":"published","published":"2023-12-18T19:15:08.72Z","modified":"2026-10-26T17:17:58.659688012Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-32205","title":"CVE-2023-51384 affecting package openssh for versions less than 8.9p1-3","description":"In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.","status":"published","published":"2023-12-18T19:15:08Z","modified":"2026-04-21T04:26:42.957388Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-35081","title":"CVE-2023-51384 affecting package openssh for versions less than 9.7p1-1","description":"In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.","status":"published","published":"2023-12-18T19:15:08Z","modified":"2026-04-21T04:48:14.760765Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"BELL-CVE-2023-51384","status":"published","published":"2023-12-20T05:57:15.782697Z","modified":"2026-01-26T09:36:47.4125Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:18.192656Z"},{"id":"CVE-2023-51384","description":"In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.","status":"published","published":"2023-12-18T00:00:00Z","modified":"2026-10-28T10:36:12.749368645Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"DEBIAN-CVE-2023-51384","description":"In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.","status":"published","published":"2023-12-18T19:15:08.72Z","modified":"2026-10-26T18:02:36.25311041Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:40.586408Z"},{"id":"JLSEC-2026-69","description":"In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.","status":"published","published":"2026-04-09T21:32:46.691Z","modified":"2026-07-18T00:02:19.941691038Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"ROOT-OS-ALPINE-318-CVE-2023-51384","title":"CVE-2023-51384 in openssh - Patched by Root","description":"Root has patched CVE-2023-51384 in the openssh package for Root:Alpine:3.18. Multiple fixed versions available.","status":"published","published":"2026-11-06T11:05:54Z","modified":"2026-11-06T12:15:03.848475875Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-06T12:43:06.926783Z"},{"id":"UBUNTU-CVE-2023-51384","description":"In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.","status":"published","published":"2023-12-20T00:00:00Z","modified":"2026-05-29T18:00:22.708627066Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"MGASA-2024-0010","title":"Updated openssh packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nThe PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an\ninsufficiently trustworthy search path, leading to remote code execution\nif an agent is forwarded to an attacker-controlled system.\n(CVE-2023-38408)\nPrefix Truncation Attacks in SSH Specification (Terrapin Attack).\n(CVE-2023-48795)\nIn ssh-agent in OpenSSH before 9.6, certain destination constraints can\nbe incompletely applied. When destination constraints are specified\nduring addition of PKCS#11-hosted private keys, these constraints are\nonly applied to the first key, even if a PKCS#11 token returns multiple\nkeys. (CVE-2023-51384)\nIn ssh in OpenSSH before 9.6, OS command injection might occur if a user\nname or host name has shell metacharacters, and this name is referenced\nby an expansion token in certain situations. For example, an untrusted\nGit repository can have a submodule with shell metacharacters in a user\nname or host name. (CVE-2023-51385)\n","status":"published","published":"2024-01-14T22:23:43Z","modified":"2026-04-16T04:41:56.357688725Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"USN-6565-1","title":"openssh vulnerabilities","description":"It was discovered that OpenSSH incorrectly handled supplemental groups when\nrunning helper programs for AuthorizedKeysCommand and\nAuthorizedPrincipalsCommand as a different user. An attacker could possibly\nuse this issue to escalate privileges. This issue only affected Ubuntu\n20.04 LTS. (CVE-2021-41617)\n\nIt was discovered that OpenSSH incorrectly added destination constraints\nwhen PKCS#11 token keys were added to ssh-agent, contrary to expectations.\nThis issue only affected Ubuntu 22.04 LTS, and Ubuntu 23.04.\n(CVE-2023-51384)\n\nIt was discovered that OpenSSH incorrectly handled user names or host names\nwith shell metacharacters. An attacker could possibly use this issue to\nperform OS command injection. (CVE-2023-51385)\n","status":"published","published":"2024-01-03T18:00:01Z","modified":"2026-05-29T18:00:44.760230769Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}