Incomplete Application of Destination Constraints in OpenSSH
Summary
CVE-2023-51384: In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. Affects openssh across 2 version ranges.
< 9.0_p1-r5
< 881d9c6af9da4257c69c327c4e2f1508b2fa754b
Fixed in 9.0_p1-r5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenSSH is an open-source suite of secure networking utilities that provides secure remote login, file transfer, and tunneling capabilities. It is widely used in various operating systems and provides encrypted communication channels over unsecured networks. The vulnerability (CVE-2023-51384) affects OpenSSH versions before 9.6 and involves the incomplete application of destination constraints when adding PKCS#11-hosted private keys.
Vulnerability Detail
The vulnerability arises when destination constraints are specified during the addition of PKCS#11-hosted private keys in ssh-agent. These constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys. This incomplete application of destination constraints can lead to unauthorized access to private keys by an attacker. The impact of this vulnerability can result in the compromise of sensitive information and unauthorized access to systems.
How To Fix
Minimum fixed version
9.0_p1-r5
This is the first release that contains the fix.
sudo apk add --upgrade opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually add each PKCS#11-hosted private key separately, ensuring that the destination constraints are correctly applied to each key. However, this workaround can be cumbersome and error-prone, so it is strongly advised to apply the official fix by updating OpenSSH.
Conclusion
The incomplete application of destination constraints in OpenSSH can lead to unauthorized access to private keys and potential compromise of sensitive information. It is crucial to update OpenSSH to version 9.6 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is an open-source suite of secure networking utilities that provides secure remote login, file transfer, and tunneling capabilities.
PKCS#11 is a standard interface for cryptographic tokens, such as smart cards and hardware security modules, to perform cryptographic operations.
The vulnerability occurs due to the incomplete application of destination constraints when adding PKCS#11-hosted private keys in ssh-agent.
The vulnerability can lead to unauthorized access to private keys, potentially resulting in the compromise of sensitive information and unauthorized access to systems.
To fix this vulnerability, update OpenSSH to version 9.6 or later, which includes the necessary patches to address the incomplete application of destination constraints.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
