OpenSSH Moderate Vulnerability: Double-Free Vulnerability in openssh
Summary
ALSA-2023:2645: Moderate: openssh security update. Affects openssh versions < 8.7p1-29.el9_2. Fixed in 8.7p1-29.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is an SSH protocol implementation used by various Linux, UNIX, and similar operating systems. It provides the necessary files for both the OpenSSH client and server. OpenSSH allows secure remote access and file transfer between systems.
Vulnerability Detail
The vulnerability in OpenSSH is related to the functions order_hostkeyalgs() and list_hostkey_types(). This vulnerability can lead to a double-free vulnerability, which could potentially be exploited by an attacker. A double-free vulnerability occurs when a program attempts to free the same memory location twice, which can result in memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service.
How To Fix
Minimum fixed version
8.7p1-29.el9_2
This is the first release that contains the fix.
sudo dnf update opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the security update as soon as possible.
Conclusion
OpenSSH is vulnerable to a double-free vulnerability, which could potentially allow an attacker to execute arbitrary code or cause a denial of service. It is crucial to update OpenSSH to version 8.7p1-29.el9_2 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is an SSH protocol implementation used for secure remote access and file transfer between systems.
A double-free vulnerability occurs when a program attempts to free the same memory location twice, which can result in memory corruption and potential exploitation by an attacker.
The impact of this vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial of service.
To fix this vulnerability, update OpenSSH to version 8.7p1-29.el9_2 or later.
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the security update.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
