{"id":"CVE-2024-6387","aliases":["ALPINE-CVE-2024-6387","ALSA-2024:4312","AZL-43024","AZL-43030","BELL-CVE-2024-6387","CLSA-2024-1720093829","DEBIAN-CVE-2024-6387","DSA-5724-1","EUVD-2024-47981","GHSA-2x8c-95vh-gfv4","JLSEC-2026-71","MGASA-2024-0250","OESA-2024-1781","OESA-2024-1782","OESA-2024-1783","OESA-2024-1784","RHSA-2024:4312","RHSA-2024:4340","RHSA-2024:4389","SUSE-SU-2024:2275-1","SUSE-SU-2024:2275-2","SUSE-SU-2025:20009-1","UBUNTU-CVE-2024-6387","USN-6859-1","openSUSE-SU-2024:14088-1"],"status":"published","title":"Openssh: regresshion - race condition in ssh allows rce/dos","description":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.99506,"percentile":0.99945,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-362","CWE-364"],"published":"2024-07-01T00:00:00Z","modified":"2026-11-05T10:45:21Z","exploits":[{"source":"pocgithub","id":"7etsuo/cve-2024-6387-poc","title":"7etsuo/cve-2024-6387-poc","date":"2024-07-01","url":"https://github.com/7etsuo/cve-2024-6387-poc"},{"source":"pocgithub","id":"FerasAlrimali/CVE-2024-6387-POC","title":"FerasAlrimali/CVE-2024-6387-POC","date":"2024-07-01","url":"https://github.com/FerasAlrimali/CVE-2024-6387-POC"},{"source":"pocgithub","id":"acrono/cve-2024-6387-poc","title":"acrono/cve-2024-6387-poc","date":"2024-07-01","url":"https://github.com/acrono/cve-2024-6387-poc"},{"source":"pocgithub","id":"bigb0x/CVE-2024-6387","title":"bigb0x/CVE-2024-6387","date":"2024-07-01","url":"https://github.com/bigb0x/CVE-2024-6387"},{"source":"pocgithub","id":"getdrive/CVE-2024-6387-PoC","title":"getdrive/CVE-2024-6387-PoC","date":"2024-07-01","url":"https://github.com/getdrive/CVE-2024-6387-PoC"},{"source":"pocgithub","id":"jack0we/CVE-2024-6387","title":"jack0we/CVE-2024-6387","date":"2024-07-01","url":"https://github.com/jack0we/CVE-2024-6387"},{"source":"pocgithub","id":"lflare/cve-2024-6387-poc","title":"lflare/cve-2024-6387-poc","date":"2024-07-01","url":"https://github.com/lflare/cve-2024-6387-poc"},{"source":"pocgithub","id":"passwa11/cve-2024-6387-poc","title":"passwa11/cve-2024-6387-poc","date":"2024-07-01","url":"https://github.com/passwa11/cve-2024-6387-poc"},{"source":"pocgithub","id":"wiggels/regresshion-check","title":"wiggels/regresshion-check","date":"2024-07-01","url":"https://github.com/wiggels/regresshion-check"},{"source":"pocgithub","id":"xaitax/CVE-2024-6387_Check","title":"xaitax/CVE-2024-6387_Check","date":"2024-07-01","url":"https://github.com/xaitax/CVE-2024-6387_Check"},{"source":"pocgithub","id":"zgzhang/cve-2024-6387-poc","title":"zgzhang/cve-2024-6387-poc","date":"2024-07-01","url":"https://github.com/zgzhang/cve-2024-6387-poc"},{"source":"pocgithub","id":"ACHUX21/checker-CVE-2024-6387","title":"ACHUX21/checker-CVE-2024-6387","date":"2024-07-02","url":"https://github.com/ACHUX21/checker-CVE-2024-6387"},{"source":"pocgithub","id":"AiGptCode/ssh_exploiter_CVE-2024-6387","title":"AiGptCode/ssh_exploiter_CVE-2024-6387","date":"2024-07-02","url":"https://github.com/AiGptCode/ssh_exploiter_CVE-2024-6387"},{"source":"pocgithub","id":"BrandonLynch2402/cve-2024-6387-nuclei-template","title":"BrandonLynch2402/cve-2024-6387-nuclei-template","date":"2024-07-02","url":"https://github.com/BrandonLynch2402/cve-2024-6387-nuclei-template"},{"source":"pocgithub","id":"CiderAndWhisky/regression-scanner","title":"CiderAndWhisky/regression-scanner","date":"2024-07-02","url":"https://github.com/CiderAndWhisky/regression-scanner"},{"source":"pocgithub","id":"CognisysGroup/CVE-2024-6387-Checker","title":"CognisysGroup/CVE-2024-6387-Checker","date":"2024-07-02","url":"https://github.com/CognisysGroup/CVE-2024-6387-Checker"},{"source":"pocgithub","id":"MrR0b0t19/CVE-2024-6387-Exploit-POC","title":"MrR0b0t19/CVE-2024-6387-Exploit-POC","date":"2024-07-02","url":"https://github.com/MrR0b0t19/CVE-2024-6387-Exploit-POC"},{"source":"pocgithub","id":"Mufti22/CVE-2024-6387-checkher","title":"Mufti22/CVE-2024-6387-checkher","date":"2024-07-02","url":"https://github.com/Mufti22/CVE-2024-6387-checkher"},{"source":"pocgithub","id":"P4x1s/CVE-2024-6387","title":"P4x1s/CVE-2024-6387","date":"2024-07-02","url":"https://github.com/P4x1s/CVE-2024-6387"},{"source":"pocgithub","id":"PrincipalAnthony/CVE-2024-6387-Updated-x64bit","title":"PrincipalAnthony/CVE-2024-6387-Updated-x64bit","date":"2024-07-02","url":"https://github.com/PrincipalAnthony/CVE-2024-6387-Updated-x64bit"},{"source":"pocgithub","id":"R4Tw1z/CVE-2024-6387","title":"R4Tw1z/CVE-2024-6387","date":"2024-07-02","url":"https://github.com/R4Tw1z/CVE-2024-6387"},{"source":"pocgithub","id":"RickGeex/CVE-2024-6387-Checker","title":"RickGeex/CVE-2024-6387-Checker","date":"2024-07-02","url":"https://github.com/RickGeex/CVE-2024-6387-Checker"},{"source":"pocgithub","id":"TAM-K592/CVE-2024-6387","title":"TAM-K592/CVE-2024-6387","date":"2024-07-02","url":"https://github.com/TAM-K592/CVE-2024-6387"},{"source":"pocgithub","id":"ahlfors/CVE-2024-6387","title":"ahlfors/CVE-2024-6387","date":"2024-07-02","url":"https://github.com/ahlfors/CVE-2024-6387"},{"source":"pocgithub","id":"betancour/OpenSSH-Vulnerability-test","title":"betancour/OpenSSH-Vulnerability-test","date":"2024-07-02","url":"https://github.com/betancour/OpenSSH-Vulnerability-test"},{"source":"exploitdb","id":"EDB-52269","title":"OpenSSH server (sshd) 9.8p1 - Race Condition","type":"remote","platform":"linux","date":"2025-04-22","url":"https://www.exploit-db.com/exploits/52269"}],"exploits_more":72,"fixes":[{"ecosystem":"Alpine:v3.17","package":"openssh","fixed_in":["9.1_p1-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openssh","fixed_in":["9.3_p2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openssh","fixed_in":["9.6_p1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openssh","fixed_in":["9.7_p1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssh","fixed_in":["9.8_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssh","fixed_in":["9.8_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssh","fixed_in":["9.8_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssh","fixed_in":["9.8_p1-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"openssh","fixed_in":["8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"openssh-askpass","fixed_in":["8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"openssh-clients","fixed_in":["8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"openssh-keycat","fixed_in":["8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"openssh-server","fixed_in":["8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"pam_ssh_agent_auth","fixed_in":["0.10.4-5.38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"openssh","fixed_in":["9.8p1-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"openssh","fixed_in":["8.9p1-6"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openssh","fixed_in":["9.1_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssh","fixed_in":["9.8_p1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openssh","fixed_in":["9.1_p1-r8"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssh","fixed_in":["9.8_p1-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh","fixed_in":["8.7p1-30.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh-askpass","fixed_in":["8.7p1-30.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh-clients","fixed_in":["8.7p1-30.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh-keycat","fixed_in":["8.7p1-30.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh-server","fixed_in":["8.7p1-30.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh-sk-dummy","fixed_in":["8.7p1-30.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"pam_ssh_agent_auth","fixed_in":["0.10.4-5.30.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openssh","fixed_in":["1:9.2p1-2+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssh","fixed_in":["1:9.7p1-7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssh","fixed_in":["1:9.7p1-7"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenSSH_jll","fixed_in":["9.9.1+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"openssh","fixed_in":["9.3p1-2.2.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"openssh","fixed_in":["9.3p2-4.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"openssh","fixed_in":["8.8p1-31.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"openssh","fixed_in":["8.8p1-31.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"openssh","fixed_in":["8.8p1-31.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-askpass","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-askpass-debuginfo","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-clients-debuginfo","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-debuginfo","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-debugsource","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-keycat-debuginfo","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-server-debuginfo","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-sk-dummy-debuginfo","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam_ssh_agent_auth","fixed_in":["0:0.10.4-5.38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam_ssh_agent_auth-debuginfo","fixed_in":["0:0.10.4-5.38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-askpass-debuginfo","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-clients","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-clients-debuginfo","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-debuginfo","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-debugsource","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-keycat","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-keycat-debuginfo","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-server","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-server-debuginfo","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-sk-dummy-debuginfo","fixed_in":["0:8.7p1-38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"pam_ssh_agent_auth-debuginfo","fixed_in":["0:0.10.4-5.38.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"openssh-askpass","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"openssh-askpass-debuginfo","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"openssh-clients-debuginfo","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"openssh-debuginfo","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"openssh-debugsource","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"openssh-keycat-debuginfo","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"openssh-server-debuginfo","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"openssh-sk-dummy-debuginfo","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"pam_ssh_agent_auth","fixed_in":["0:0.10.4-5.30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"pam_ssh_agent_auth-debuginfo","fixed_in":["0:0.10.4-5.30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-askpass-debuginfo","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-clients","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-clients-debuginfo","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-debuginfo","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-debugsource","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-keycat","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-keycat-debuginfo","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-server","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-server-debuginfo","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-sk-dummy-debuginfo","fixed_in":["0:8.7p1-30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"pam_ssh_agent_auth-debuginfo","fixed_in":["0:0.10.4-5.30.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openssh-askpass","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openssh-askpass-debuginfo","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openssh-clients-debuginfo","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openssh-debuginfo","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openssh-debugsource","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openssh-keycat-debuginfo","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openssh-server-debuginfo","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"pam_ssh_agent_auth","fixed_in":["0:0.10.4-4.12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"pam_ssh_agent_auth-debuginfo","fixed_in":["0:0.10.4-4.12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-askpass-debuginfo","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-clients","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-clients-debuginfo","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-debuginfo","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-debugsource","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-keycat","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-keycat-debuginfo","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-server","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-server-debuginfo","fixed_in":["0:8.7p1-12.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"pam_ssh_agent_auth-debuginfo","fixed_in":["0:0.10.4-4.12.el9_0.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openssh","fixed_in":["9.6p1-150600.6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"openssh-askpass-gnome","fixed_in":["9.6p1-150600.6.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"openssh","fixed_in":["9.6p1-150600.6.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"openssh-askpass-gnome","fixed_in":["9.6p1-150600.6.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"openssh","fixed_in":["1:8.9p1-3ubuntu0.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"openssh","fixed_in":["1:9.6p1-3ubuntu13.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"openssh","fixed_in":["9.6p1-10.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.6"},{"fixed":"9.1_p1-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.6"},{"fixed":"9.3_p2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.6"},{"fixed":"9.6_p1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.6"},{"fixed":"9.7_p1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.6"},{"fixed":"9.8_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.6"},{"fixed":"9.8_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.6"},{"fixed":"9.8_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.6"},{"fixed":"9.8_p1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-5.38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.8p1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9p1-6"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1_p1-r3"},{"fixed":"9.1_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.3_p1-r7"},{"fixed":"9.8_p1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1_p1-r3"},{"fixed":"9.1_p1-r8"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.3_p1-r7"},{"fixed":"9.8_p1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-30.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-30.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-30.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-30.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-30.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssh-sk-dummy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7p1-30.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-5.30.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.2p1-2+deb12u3"}]}],"versions":["1:9.2p1-2","1:9.2p1-2+deb12u1","1:9.2p1-2+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.7p1-7"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.7p1-7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.2p1-2+deb12u3"}]}],"versions":["1:9.2p1-2","1:9.2p1-2+deb12u1","1:9.2p1-2+deb12u2"]},{"source":"osv","ecosystem":"Julia","package":"OpenSSH_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.9.0+0"},{"fixed":"9.9.1+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3p1-2.2.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3p2-4.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8p1-31.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8p1-31.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8p1-31.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssh-sk-dummy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-5.38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-5.38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssh-sk-dummy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-5.38.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"openssh-sk-dummy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-5.30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-5.30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"openssh-sk-dummy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-5.30.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-4.12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-4.12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.7p1-12.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-4.12.el9_0.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-150600.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-150600.6.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-150600.6.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-150600.6.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-150600.6.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-150600.6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.9p1-3ubuntu0.10"}]}],"versions":["1:8.4p1-6ubuntu2","1:8.7p1-2","1:8.7p1-2build1","1:8.7p1-4","1:8.8p1-1","1:8.9p1-3","1:8.9p1-3ubuntu0.1","1:8.9p1-3ubuntu0.3","1:8.9p1-3ubuntu0.4","1:8.9p1-3ubuntu0.5","1:8.9p1-3ubuntu0.6","1:8.9p1-3ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.6p1-3ubuntu13.3"}]}],"versions":["1:9.3p1-1ubuntu3","1:9.4p1-1ubuntu1","1:9.6p1-3ubuntu1","1:9.6p1-3ubuntu2","1:9.6p1-3ubuntu11","1:9.6p1-3ubuntu12","1:9.6p1-3ubuntu13"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.9p1-3ubuntu0.10"}]}],"versions":["1:8.4p1-6ubuntu2","1:8.7p1-2","1:8.7p1-2build1","1:8.7p1-4","1:8.8p1-1","1:8.9p1-3","1:8.9p1-3ubuntu0.1","1:8.9p1-3ubuntu0.3","1:8.9p1-3ubuntu0.4","1:8.9p1-3ubuntu0.5","1:8.9p1-3ubuntu0.6","1:8.9p1-3ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.6p1-3ubuntu13.3"}]}],"versions":["1:9.3p1-1ubuntu3","1:9.4p1-1ubuntu1","1:9.6p1-3ubuntu1","1:9.6p1-3ubuntu2","1:9.6p1-3ubuntu11","1:9.6p1-3ubuntu12","1:9.6p1-3ubuntu13"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-10.1"}]}]}],"products":[{"vendor":"almalinux","product":"almalinux"},{"vendor":"amazon","product":"amazon_linux"},{"vendor":"apple","product":"macos"},{"vendor":"arista","product":"eos"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"freebsd","product":"freebsd"},{"vendor":"netapp","product":"500f_firmware"},{"vendor":"netapp","product":"8300_firmware"},{"vendor":"netapp","product":"8700_firmware"},{"vendor":"netapp","product":"a150_firmware"},{"vendor":"netapp","product":"a1k_firmware"},{"vendor":"netapp","product":"a220_firmware"},{"vendor":"netapp","product":"a250_firmware"},{"vendor":"netapp","product":"a400_firmware"},{"vendor":"netapp","product":"a700s_firmware"},{"vendor":"netapp","product":"a70_firmware"},{"vendor":"netapp","product":"a800_firmware"},{"vendor":"netapp","product":"a900_firmware"},{"vendor":"netapp","product":"a90_firmware"},{"vendor":"netapp","product":"a9500_firmware"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"bootstrap_os"},{"vendor":"netapp","product":"c190_firmware"},{"vendor":"netapp","product":"c250_firmware"},{"vendor":"netapp","product":"c400_firmware"},{"vendor":"netapp","product":"c800_firmware"},{"vendor":"netapp","product":"e-series_santricity_os_controller"},{"vendor":"netapp","product":"fas2720_firmware"},{"vendor":"netapp","product":"fas2750_firmware"},{"vendor":"netapp","product":"fas2820_firmware"},{"vendor":"netapp","product":"ontap"},{"vendor":"netapp","product":"ontap_select_deploy_administration_utility"},{"vendor":"netapp","product":"ontap_tools"},{"vendor":"netbsd","product":"netbsd"},{"vendor":"openbsd","product":"openssh"},{"vendor":"red hat","product":"red hat ceph storage 5"},{"vendor":"red hat","product":"red hat ceph storage 6"},{"vendor":"red hat","product":"red hat ceph storage 7"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.0 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 extended update support"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.13"},{"vendor":"red hat","product":"red hat openshift container platform 4.14"},{"vendor":"red hat","product":"red hat openshift container platform 4.15"},{"vendor":"red hat","product":"red hat openshift container platform 4.16"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_for_arm_64"},{"vendor":"redhat","product":"enterprise_linux_for_arm_64_eus"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems_eus"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian_eus"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"openshift_container_platform"},{"vendor":"siemens","product":"industrial edge management os (iem-os)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"sinamics iiot module"},{"vendor":"siemens","product":"sinema remote connect server"},{"vendor":"siemens","product":"sinumerik one"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"sonicwall","product":"sma_6200_firmware"},{"vendor":"sonicwall","product":"sma_6210_firmware"},{"vendor":"sonicwall","product":"sma_7200_firmware"},{"vendor":"sonicwall","product":"sma_7210_firmware"},{"vendor":"sonicwall","product":"sma_8200v_firmware"},{"vendor":"sonicwall","product":"sra_ex_7000_firmware"},{"vendor":"suse","product":"linux_enterprise_micro"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:4312","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4340","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4389","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4469","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4474","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4479","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4484","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-6387","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","report","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2294604","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Third Party Advisory","report","web"]},{"url":"https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","tags":["x_transferred","Exploit","Third Party Advisory","article","web"]},{"url":"https://www.openssh.com/txt/release-9.8","tags":["x_transferred","Release Notes","Third Party Advisory","web","article"]},{"url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","tags":["x_transferred","Exploit","Third Party Advisory","web","article","report"]},{"url":"https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://www.exploit-db.com/exploits/52269","tags":["Exploit","web"]},{"url":"https://packetstorm.news/files/id/190587/","tags":["Broken Link","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/01/12","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/01/13","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/02/1","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/03/1","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/03/11","tags":["x_transferred","Exploit","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/03/2","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/03/3","tags":["x_transferred","Mailing List","Patch","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/03/4","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/03/5","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/04/1","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/04/2","tags":["x_transferred","Exploit","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/08/2","tags":["x_transferred","Exploit","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/08/3","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/09/2","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/09/5","tags":["x_transferred","Exploit","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/10/1","tags":["x_transferred","Exploit","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/10/2","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/10/3","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/10/4","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/10/6","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/11/1","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/11/3","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/23/4","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/23/6","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/28/2","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/28/3","tags":["x_transferred","Mailing List","web"]},{"url":"https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/","tags":["x_transferred","Press/Media Coverage","Third Party Advisory","web"]},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server","tags":["x_transferred","Press/Media Coverage","Third Party Advisory","article","web"]},{"url":"https://explore.alas.aws.amazon.com/CVE-2024-6387.html","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://forum.vmssoftware.com/viewtopic.php?f=8\u0026t=9132","tags":["x_transferred","Issue Tracking","web"]},{"url":"https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc","tags":["x_transferred","Release Notes","advisory","web"]},{"url":"https://github.com/AlmaLinux/updates/issues/629","tags":["x_transferred","Issue Tracking","report","web"]},{"url":"https://github.com/Azure/AKS/issues/4379","tags":["x_transferred","Issue Tracking","report","web"]},{"url":"https://github.com/PowerShell/Win32-OpenSSH/discussions/2248","tags":["x_transferred","Issue Tracking","web"]},{"url":"https://github.com/PowerShell/Win32-OpenSSH/issues/2249","tags":["x_transferred","Issue Tracking","report","web"]},{"url":"https://github.com/microsoft/azurelinux/issues/9555","tags":["x_transferred","Issue Tracking","report","web"]},{"url":"https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09","tags":["x_transferred","Patch","fix","web"]},{"url":"https://github.com/oracle/oracle-linux/issues/149","tags":["x_transferred","Issue Tracking","report","web"]},{"url":"https://github.com/rapier1/hpn-ssh/issues/87","tags":["x_transferred","Issue Tracking","report","web"]},{"url":"https://github.com/zgzhang/cve-2024-6387-poc","tags":["x_transferred","Third Party Advisory","package","web"]},{"url":"https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html","tags":["x_transferred","Mailing List","Release Notes","web"]},{"url":"https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html","tags":["x_transferred","Mailing List","Patch","web"]},{"url":"https://news.ycombinator.com/item?id=40843778","tags":["x_transferred","Issue Tracking","Patch","web"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-6387","tags":["x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240701-0001/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://sig-security.rocky.page/issues/CVE-2024-6387/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/","tags":["x_transferred","Press/Media Coverage","Third Party Advisory","web"]},{"url":"https://ubuntu.com/security/CVE-2024-6387","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://ubuntu.com/security/notices/USN-6859-1","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do","tags":["x_transferred","Third Party Advisory","article","web"]},{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html","tags":["x_transferred","Third Party Advisory","article","web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6387.html","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://www.theregister.com/2024/07/01/regresshion_openssh/","tags":["x_transferred","Press/Media Coverage","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT214119","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT214118","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://support.apple.com/kb/HT214120","tags":["x_transferred","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/20","tags":["x_transferred","Mailing List","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/18","tags":["x_transferred","Mailing List","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/19","tags":["x_transferred","Mailing List","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-446545.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6387","tags":["web","advisory"]},{"url":"https://www.theregister.com/2024/07/01/regresshion_openssh"},{"url":"https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1"},{"url":"https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution"},{"url":"https://security.netapp.com/advisory/ntap-20240701-0001"},{"url":"https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux"},{"url":"https://sig-security.rocky.page/issues/CVE-2024-6387"},{"url":"https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY"},{"url":"https://packetstorm.news/files/id/190587"},{"url":"https://github.com/advisories/GHSA-2x8c-95vh-gfv4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-6387","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2294604","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-4312.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-6387","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-38","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2024-1720093829.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://www.openssh.com/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6387.json","tags":["advisory"]},{"url":"https://anongit.mindrot.org/openssh.git","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2024-0250.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33346","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2024/msg00135.html","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2024/07/01/3","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1781","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1782","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1783","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1784","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4312.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6387","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4340.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4389.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242275-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1226642","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6387","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242275-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520009-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1217950","tags":["report"]},{"url":"https://bugzilla.suse.com/1218215","tags":["report"]},{"url":"https://bugzilla.suse.com/1227318","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-51385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39894","tags":["web"]},{"url":"https://ubuntu.com/blog/ubuntu-regresshion-security-fix","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-6387","title":"Openssh: regresshion - race condition in ssh allows rce/dos","description":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","status":"published","published":"2024-07-01T12:37:25.431Z","modified":"2026-11-06T20:21:49.972Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-364"],"updated_at":"2026-11-06T21:31:06.649526Z"}],"euvd":[{"id":"EUVD-2024-47981","description":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","status":"published","published":"2024-07-01T12:37:25Z","modified":"2026-11-06T20:21:49Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T21:07:00.111123Z"}],"ghsa":[{"id":"GHSA-2x8c-95vh-gfv4","title":"A signal handler race condition was found in OpenSSH's server (sshd), where a client does not...","description":"A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().","status":"published","published":"2024-07-01T15:32:33Z","modified":"2026-05-12T12:33:03Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362","CWE-364"],"updated_at":"2026-11-02T15:08:02.626987Z"}],"nvd":[{"id":"CVE-2024-6387","description":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","status":"published","published":"2024-07-01T13:15:06.467Z","modified":"2026-11-06T21:17:02.587Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-364","CWE-362"],"updated_at":"2026-11-07T00:02:29.674168Z"}],"osv":[{"id":"ALPINE-CVE-2024-6387","description":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","status":"published","published":"2024-07-01T13:15:06.467Z","modified":"2026-11-02T11:17:50.133535239Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-43024","title":"CVE-2024-6387 affecting package openssh for versions less than 9.8p1-1","description":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","status":"published","published":"2024-07-01T13:15:06Z","modified":"2026-10-22T15:09:00Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-43030","title":"CVE-2024-6387 affecting package openssh for versions less than 8.9p1-6","description":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","status":"published","published":"2024-07-01T13:15:06Z","modified":"2026-04-21T04:30:51.818358Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"BELL-CVE-2024-6387","status":"published","published":"2024-07-02T05:57:08.378968Z","modified":"2026-01-26T09:37:09.533024Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2024-6387","title":"Openssh: regresshion - race condition in ssh allows rce/dos","description":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","status":"published","published":"2024-07-01T12:37:25.431Z","modified":"2026-11-08T10:45:12.529492619Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-364"],"updated_at":"2026-11-07T03:07:55.074849Z"},{"id":"DEBIAN-CVE-2024-6387","description":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","status":"published","published":"2024-07-01T13:15:06.467Z","modified":"2026-11-07T09:47:26.137946641Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"JLSEC-2026-71","description":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","status":"published","published":"2026-04-09T21:32:46.691Z","modified":"2026-07-18T00:01:02.902695202Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"OESA-2024-1781","title":"openssh security update","description":"OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \\ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \\ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \\ capabilities, several authentication methods, and sophisticated configuration options.\r\n\r\nSecurity Fix(es):\r\n\r\nA signal handler race condition was found in OpenSSH\u0026apos;s server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd\u0026apos;s SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().(CVE-2024-6387)","status":"published","published":"2024-07-02T11:07:14Z","modified":"2026-08-18T01:18:27.61709872Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1782","title":"openssh security update","description":"OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \\ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \\ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \\ capabilities, several authentication methods, and sophisticated configuration options.\r\n\r\nSecurity Fix(es):\r\n\r\nA signal handler race condition was found in OpenSSH\u0026apos;s server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd\u0026apos;s SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().(CVE-2024-6387)","status":"published","published":"2024-07-02T11:07:15Z","modified":"2026-08-18T01:18:27.601371083Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1783","title":"openssh security update","description":"OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \\ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \\ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \\ capabilities, several authentication methods, and sophisticated configuration options.\r\n\r\nSecurity Fix(es):\r\n\r\nA signal handler race condition was found in OpenSSH\u0026apos;s server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd\u0026apos;s SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().(CVE-2024-6387)","status":"published","published":"2024-07-02T11:07:15Z","modified":"2026-08-18T01:18:27.7982323Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1784","title":"openssh security update","description":"OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \\ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \\ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \\ capabilities, several authentication methods, and sophisticated configuration options.\r\n\r\nSecurity Fix(es):\r\n\r\nA signal handler race condition was found in OpenSSH\u0026apos;s server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd\u0026apos;s SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().(CVE-2024-6387)","status":"published","published":"2024-07-02T11:07:15Z","modified":"2026-08-18T01:18:27.795382125Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2024:4312","title":"Red Hat Security Advisory: openssh security update","status":"published","published":"2024-09-14T02:10:57Z","modified":"2026-10-15T10:08:20Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:4340","title":"Red Hat Security Advisory: openssh security update","status":"published","published":"2024-09-14T02:11:07Z","modified":"2026-10-15T10:08:20Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:4389","title":"Red Hat Security Advisory: openssh security update","status":"published","published":"2024-09-14T02:11:15Z","modified":"2026-10-15T10:08:22Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"UBUNTU-CVE-2024-6387","description":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","status":"published","published":"2024-07-01T00:00:00Z","modified":"2026-02-04T04:18:00.629884Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"ALSA-2024:4312","title":"Important: openssh security update","description":"OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.\n\nSecurity Fix(es):\n\n* openssh: Possible remote code execution due to a race condition in signal handling (CVE-2024-6387)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-07-03T00:00:00Z","modified":"2026-10-29T11:31:46.749486541Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2024-1720093829","title":"openssh: Fix of CVE-2024-6387","description":"- CVE-2024-6387: the signal handler race condition itself fixed by commenting\n  out the async-signal-unsafe code from the sshsigdie() function","status":"published","published":"2024-07-04T11:50:32Z","modified":"2026-06-01T00:30:17.658679346Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"DSA-5724-1","title":"openssh - security update","status":"published","published":"2024-07-01T00:00:00Z","modified":"2026-03-09T02:11:24.023956Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0250","title":"Updated openssh packages fix security vulnerability","description":"regreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems.\n(CVE-2024-6387)\n","status":"published","published":"2024-07-03T16:36:28Z","modified":"2026-04-16T04:44:16.881684155Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14088-1","title":"openssh-9.6p1-10.1 on GA media","description":"These are all security issues fixed in the openssh-9.6p1-10.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-02T00:00:00Z","modified":"2026-02-04T04:32:20.843334Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:2275-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- CVE-2024-6387: Fixed race condition in a signal handler (bsc#1226642)\n","status":"published","published":"2024-07-03T21:59:21Z","modified":"2026-02-04T03:28:20.527827Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2275-2","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- CVE-2024-6387: Fixed race condition in a signal handler (bsc#1226642)\n","status":"published","published":"2024-07-03T21:59:21Z","modified":"2026-02-04T02:14:52.982183Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2025:20009-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- CVE-2024-39894: Fixed timing attacks against echo-off password entry (bsc#1227318)\n- CVE-2024-6387: Fixed race condition in a signal handler (bsc#1226642).\n","status":"published","published":"2025-02-03T08:47:06Z","modified":"2026-03-23T04:50:01.776068Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-6859-1","title":"openssh vulnerability","description":"It was discovered that OpenSSH incorrectly handled signal management. A\nremote attacker could use this issue to bypass authentication and remotely\naccess systems without proper credentials.\n","status":"published","published":"2024-07-01T09:06:31Z","modified":"2026-02-10T04:44:20Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}