CVE-2023-38408

תיאור (מקור, אנגלית)

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

מדדים

CVSS 3.1

9.8 (CRITICAL) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — סבירות ניצול

80% (אחוזון 100) נכון ל-24/10/2026

CWE

CWE-428

מוצרים מושפעים

openbsd: openssh; fedoraproject: fedora

קישורים

• https://www.openssh.com/security.html Vendor Advisory
• https://www.openssh.com/security.html Vendor Advisory
• https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8 Patch
• https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d Patch
• https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca Patch
• https://news.ycombinator.com/item?id=36790196 Issue TrackingPatch
• https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8 Patch
• https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d Patch
• https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca Patch
• https://news.ycombinator.com/item?id=36790196 Issue TrackingPatch