CVE-2023-25136

01/תיאור (מקור, אנגלית)

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

02/מוצרים מושפעים

openbsd: openssh; fedoraproject: fedora; netapp: ontap select deploy administration utility; netapp: a250 firmware; netapp: a250; netapp: 500f firmware; netapp: 500f; netapp: c250 firmware; netapp: c250

03/קישורים10

• ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.‮… PatchVendor Advisory
• ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.‮… PatchVendor Advisory
• github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d66‮… PatchThird Party Advisory
• github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d66‮… PatchThird Party Advisory
• bugzilla.mindrot.org/show_bug.cgi?id=3522 ExploitIssue TrackingThird Party Advisory
• jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-wri‮… ExploitThird Party Advisory
• www.openwall.com/lists/oss-security/2023/02/02/2 ExploitMailing ListThird Party Advisory
• bugzilla.mindrot.org/show_bug.cgi?id=3522 ExploitIssue TrackingThird Party Advisory
• jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-wri‮… ExploitThird Party Advisory
• www.openwall.com/lists/oss-security/2023/02/02/2 ExploitMailing ListThird Party Advisory