CVE-2024-6387

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-6387
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

8.1 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://seclists.org/fulldisclosure/2024/Jul/18
http://seclists.org/fulldisclosure/2024/Jul/19
http://seclists.org/fulldisclosure/2024/Jul/20
http://www.openwall.com/lists/oss-security/2024/07/01/12
http://www.openwall.com/lists/oss-security/2024/07/01/13
http://www.openwall.com/lists/oss-security/2024/07/02/1
http://www.openwall.com/lists/oss-security/2024/07/03/1
http://www.openwall.com/lists/oss-security/2024/07/03/11
http://www.openwall.com/lists/oss-security/2024/07/03/2
http://www.openwall.com/lists/oss-security/2024/07/03/3
http://www.openwall.com/lists/oss-security/2024/07/03/4
http://www.openwall.com/lists/oss-security/2024/07/03/5
http://www.openwall.com/lists/oss-security/2024/07/04/1
http://www.openwall.com/lists/oss-security/2024/07/04/2
http://www.openwall.com/lists/oss-security/2024/07/08/2
http://www.openwall.com/lists/oss-security/2024/07/08/3
http://www.openwall.com/lists/oss-security/2024/07/09/2
http://www.openwall.com/lists/oss-security/2024/07/09/5
http://www.openwall.com/lists/oss-security/2024/07/10/1
http://www.openwall.com/lists/oss-security/2024/07/10/2
http://www.openwall.com/lists/oss-security/2024/07/10/3
http://www.openwall.com/lists/oss-security/2024/07/10/4
http://www.openwall.com/lists/oss-security/2024/07/10/6
http://www.openwall.com/lists/oss-security/2024/07/11/1
http://www.openwall.com/lists/oss-security/2024/07/11/3
http://www.openwall.com/lists/oss-security/2024/07/23/4
http://www.openwall.com/lists/oss-security/2024/07/23/6
http://www.openwall.com/lists/oss-security/2024/07/28/2
http://www.openwall.com/lists/oss-security/2024/07/28/3
https://access.redhat.com/errata/RHSA-2024:4312 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4312 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4340 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4340 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4389 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4389 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4469 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4469 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4474 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4474 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4479 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4479 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4484 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4484 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-6387 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-6387 Third Party Advisory
https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/
https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/
https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server
https://bugzilla.redhat.com/show_bug.cgi?id=2294604 Issue Tracking Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2294604 Issue Tracking Third Party Advisory
https://explore.alas.aws.amazon.com/CVE-2024-6387.html
https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132
https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc
https://github.com/AlmaLinux/updates/issues/629
https://github.com/Azure/AKS/issues/4379
https://github.com/microsoft/azurelinux/issues/9555
https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09
https://github.com/oracle/oracle-linux/issues/149
https://github.com/PowerShell/Win32-OpenSSH/discussions/2248
https://github.com/PowerShell/Win32-OpenSSH/issues/2249
https://github.com/rapier1/hpn-ssh/issues/87
https://github.com/zgzhang/cve-2024-6387-poc
https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/
https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html
https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html
https://news.ycombinator.com/item?id=40843778
https://packetstorm.news/files/id/190587/
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010
https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
https://security.netapp.com/advisory/ntap-20240701-0001/
https://security-tracker.debian.org/tracker/CVE-2024-6387
https://sig-security.rocky.page/issues/CVE-2024-6387/
https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/
https://support.apple.com/kb/HT214118
https://support.apple.com/kb/HT214119
https://support.apple.com/kb/HT214120
https://ubuntu.com/security/CVE-2024-6387
https://ubuntu.com/security/notices/USN-6859-1
https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do
https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100
https://www.exploit-db.com/exploits/52269
https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc
https://www.openssh.com/txt/release-9.8 Release Notes Third Party Advisory
https://www.openssh.com/txt/release-9.8 Release Notes Third Party Advisory
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt Exploit Third Party Advisory
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt Exploit Third Party Advisory
https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html
https://www.suse.com/security/cve/CVE-2024-6387.html
https://www.theregister.com/2024/07/01/regresshion_openssh/
https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:8.5:p1:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:4.4:-:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:suse:linux_enterprise_micro:6.0:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:22.10:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:lts:*:*:*

Configuration 6 (hide)

cpe:2.3:o:amazon:linux_2023:-:*:*:*:*:*:*:*

Configuration 7 (hide)

OR cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*

Configuration 8 (hide)

OR cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p2:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p3:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p4:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:-:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:p5:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.1:p1:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.1:-:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p7:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p5:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p6:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:p6:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.3:p2:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.3:p3:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p9:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p10:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p11:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p8:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.3:p1:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.3:-:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:p7:*:*:*:*:*:*

Configuration 9 (hide)

cpe:2.3:o:netbsd:netbsd:*:*:*:*:*:*:*:*
History

24 Apr 2025, 19:15

Type Values Removed Values Added
References
  • () https://github.com/PowerShell/Win32-OpenSSH/issues/2249 -
  • () https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09 -
  • () https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010 -
  • () https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 -
  • () http://www.openwall.com/lists/oss-security/2024/07/10/6 -
  • () http://www.openwall.com/lists/oss-security/2024/07/08/2 -
  • () https://github.com/zgzhang/cve-2024-6387-poc -
  • () http://www.openwall.com/lists/oss-security/2024/07/04/1 -
  • () https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html -
  • () http://www.openwall.com/lists/oss-security/2024/07/01/13 -
  • () https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387 -
  • () https://github.com/AlmaLinux/updates/issues/629 -
  • () https://github.com/microsoft/azurelinux/issues/9555 -
  • () https://packetstorm.news/files/id/190587/ -
  • () http://www.openwall.com/lists/oss-security/2024/07/11/3 -
  • () http://www.openwall.com/lists/oss-security/2024/07/03/3 -
  • () http://www.openwall.com/lists/oss-security/2024/07/23/6 -
  • () https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/ -
  • () http://www.openwall.com/lists/oss-security/2024/07/01/12 -
  • () http://www.openwall.com/lists/oss-security/2024/07/08/3 -
  • () http://www.openwall.com/lists/oss-security/2024/07/02/1 -
  • () https://support.apple.com/kb/HT214120 -
  • () https://support.apple.com/kb/HT214118 -
  • () https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server -
  • () http://www.openwall.com/lists/oss-security/2024/07/28/3 -
  • () http://www.openwall.com/lists/oss-security/2024/07/03/4 -
  • () https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc -
  • () https://ubuntu.com/security/CVE-2024-6387 -
  • () https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/ -
  • () http://seclists.org/fulldisclosure/2024/Jul/19 -
  • () https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html -
  • () http://www.openwall.com/lists/oss-security/2024/07/23/4 -
  • () http://www.openwall.com/lists/oss-security/2024/07/10/1 -
  • () https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/ -
  • () http://www.openwall.com/lists/oss-security/2024/07/11/1 -
  • () http://www.openwall.com/lists/oss-security/2024/07/10/4 -
  • () https://explore.alas.aws.amazon.com/CVE-2024-6387.html -
  • () http://www.openwall.com/lists/oss-security/2024/07/09/2 -
  • () https://news.ycombinator.com/item?id=40843778 -
  • () https://security.netapp.com/advisory/ntap-20240701-0001/ -
  • () https://www.exploit-db.com/exploits/52269 -
  • () https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132 -
  • () http://www.openwall.com/lists/oss-security/2024/07/10/2 -
  • () http://www.openwall.com/lists/oss-security/2024/07/04/2 -
  • () https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html -
  • () https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do -
  • () http://seclists.org/fulldisclosure/2024/Jul/18 -
  • () https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc -
  • () http://www.openwall.com/lists/oss-security/2024/07/03/1 -
  • () https://github.com/rapier1/hpn-ssh/issues/87 -
  • () https://security-tracker.debian.org/tracker/CVE-2024-6387 -
  • () http://www.openwall.com/lists/oss-security/2024/07/28/2 -
  • () http://www.openwall.com/lists/oss-security/2024/07/10/3 -
  • () http://www.openwall.com/lists/oss-security/2024/07/03/11 -
  • () https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100 -
  • () https://www.theregister.com/2024/07/01/regresshion_openssh/ -
  • () https://support.apple.com/kb/HT214119 -
  • () https://www.suse.com/security/cve/CVE-2024-6387.html -
  • () https://ubuntu.com/security/notices/USN-6859-1 -
  • () https://sig-security.rocky.page/issues/CVE-2024-6387/ -
  • () http://www.openwall.com/lists/oss-security/2024/07/09/5 -
  • () http://seclists.org/fulldisclosure/2024/Jul/20 -
  • () https://github.com/oracle/oracle-linux/issues/149 -
  • () http://www.openwall.com/lists/oss-security/2024/07/03/2 -
  • () http://www.openwall.com/lists/oss-security/2024/07/03/5 -
  • () https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/ -
  • () https://github.com/Azure/AKS/issues/4379 -

14 Sep 2024, 03:15

Type Values Removed Values Added
References
  • {'url': 'https://explore.alas.aws.amazon.com/CVE-2024-6387.html', 'name': 'https://explore.alas.aws.amazon.com/CVE-2024-6387.html', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://ubuntu.com/security/CVE-2024-6387', 'name': 'https://ubuntu.com/security/CVE-2024-6387', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/28/2', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/28/2', 'tags': [], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/11/3', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/11/3', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/09/5', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/09/5', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do', 'name': 'https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09', 'name': 'https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/04/1', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/04/1', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://github.com/microsoft/azurelinux/issues/9555', 'name': 'https://github.com/microsoft/azurelinux/issues/9555', 'tags': ['Issue Tracking', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://seclists.org/fulldisclosure/2024/Jul/18', 'name': 'http://seclists.org/fulldisclosure/2024/Jul/18', 'tags': [], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/23/4', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/23/4', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://github.com/zgzhang/cve-2024-6387-poc', 'name': 'https://github.com/zgzhang/cve-2024-6387-poc', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/03/1', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/03/1', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/02/1', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/02/1', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/03/3', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/03/3', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/01/13', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/01/13', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/08/3', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/08/3', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html', 'name': 'https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc', 'name': 'https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://github.com/AlmaLinux/updates/issues/629', 'name': 'https://github.com/AlmaLinux/updates/issues/629', 'tags': ['Issue Tracking', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/03/5', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/03/5', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132', 'name': 'https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc', 'name': 'https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/', 'name': 'https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://github.com/oracle/oracle-linux/issues/149', 'name': 'https://github.com/oracle/oracle-linux/issues/149', 'tags': ['Issue Tracking', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://github.com/Azure/AKS/issues/4379', 'name': 'https://github.com/Azure/AKS/issues/4379', 'tags': ['Issue Tracking', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010', 'name': 'https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/03/11', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/03/11', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://support.apple.com/kb/HT214120', 'name': 'https://support.apple.com/kb/HT214120', 'tags': [], 'refsource': ''}
  • {'url': 'https://ubuntu.com/security/notices/USN-6859-1', 'name': 'https://ubuntu.com/security/notices/USN-6859-1', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/10/3', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/10/3', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/03/4', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/03/4', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://github.com/PowerShell/Win32-OpenSSH/issues/2249', 'name': 'https://github.com/PowerShell/Win32-OpenSSH/issues/2249', 'tags': ['Issue Tracking', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/10/2', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/10/2', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/11/1', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/11/1', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://github.com/PowerShell/Win32-OpenSSH/discussions/2248', 'name': 'https://github.com/PowerShell/Win32-OpenSSH/discussions/2248', 'tags': ['Issue Tracking', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://seclists.org/fulldisclosure/2024/Jul/19', 'name': 'http://seclists.org/fulldisclosure/2024/Jul/19', 'tags': [], 'refsource': ''}
  • {'url': 'https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/', 'name': 'https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/08/2', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/08/2', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://sig-security.rocky.page/issues/CVE-2024-6387/', 'name': 'https://sig-security.rocky.page/issues/CVE-2024-6387/', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://github.com/rapier1/hpn-ssh/issues/87', 'name': 'https://github.com/rapier1/hpn-ssh/issues/87', 'tags': ['Issue Tracking', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/23/6', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/23/6', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/09/2', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/09/2', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://security.netapp.com/advisory/ntap-20240701-0001/', 'name': 'https://security.netapp.com/advisory/ntap-20240701-0001/', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/01/12', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/01/12', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/04/2', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/04/2', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://seclists.org/fulldisclosure/2024/Jul/20', 'name': 'http://seclists.org/fulldisclosure/2024/Jul/20', 'tags': [], 'refsource': ''}
  • {'url': 'https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server', 'name': 'https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server', 'tags': ['Exploit', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://security-tracker.debian.org/tracker/CVE-2024-6387', 'name': 'https://security-tracker.debian.org/tracker/CVE-2024-6387', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/10/1', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/10/1', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100', 'name': 'https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://www.suse.com/security/cve/CVE-2024-6387.html', 'name': 'https://www.suse.com/security/cve/CVE-2024-6387.html', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html', 'name': 'https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html', 'tags': ['Mailing List', 'Patch', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/', 'name': 'https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/28/3', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/28/3', 'tags': [], 'refsource': ''}
  • {'url': 'https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html', 'name': 'https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://www.theregister.com/2024/07/01/regresshion_openssh/', 'name': 'https://www.theregister.com/2024/07/01/regresshion_openssh/', 'tags': ['Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/', 'name': 'https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/', 'tags': ['Press/Media Coverage', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/10/6', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/10/6', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/10/4', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/10/4', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'http://www.openwall.com/lists/oss-security/2024/07/03/2', 'name': 'http://www.openwall.com/lists/oss-security/2024/07/03/2', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://news.ycombinator.com/item?id=40843778', 'name': 'https://news.ycombinator.com/item?id=40843778', 'tags': ['Issue Tracking', 'Patch', 'Third Party Advisory'], 'refsource': ''}
  • {'url': 'https://support.apple.com/kb/HT214118', 'name': 'https://support.apple.com/kb/HT214118', 'tags': [], 'refsource': ''}
  • {'url': 'https://support.apple.com/kb/HT214119', 'name': 'https://support.apple.com/kb/HT214119', 'tags': [], 'refsource': ''}

30 Jul 2024, 02:15

Type Values Removed Values Added
References
  • () http://seclists.org/fulldisclosure/2024/Jul/18 -
  • () http://seclists.org/fulldisclosure/2024/Jul/20 -
  • () http://seclists.org/fulldisclosure/2024/Jul/19 -

29 Jul 2024, 22:15

Type Values Removed Values Added
References
  • () https://support.apple.com/kb/HT214120 -
  • () https://support.apple.com/kb/HT214119 -
  • () https://support.apple.com/kb/HT214118 -

29 Jul 2024, 09:15

Type Values Removed Values Added
References
  • () https://santandersecurityresearch.github.io/blog/sshing_the_masses.html -

28 Jul 2024, 21:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/28/2 -
  • () http://www.openwall.com/lists/oss-security/2024/07/28/3 -

24 Jul 2024, 18:07

Type Values Removed Values Added
CPE cpe:2.3:a:openbsd:openssh:9.8:-:*:*:*:*:*:*
References () https://github.com/PowerShell/Win32-OpenSSH/issues/2249 - Issue Tracking () https://github.com/PowerShell/Win32-OpenSSH/issues/2249 - Issue Tracking, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/03/4 - Mailing List () http://www.openwall.com/lists/oss-security/2024/07/03/4 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/10/2 - () http://www.openwall.com/lists/oss-security/2024/07/10/2 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/11/1 - () http://www.openwall.com/lists/oss-security/2024/07/11/1 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/11/3 - () http://www.openwall.com/lists/oss-security/2024/07/11/3 - Mailing List, Third Party Advisory
References () https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 - Issue Tracking () https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 - Issue Tracking, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/09/5 - () http://www.openwall.com/lists/oss-security/2024/07/09/5 - Mailing List, Third Party Advisory
References () https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do - () https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do - Third Party Advisory
References () https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09 - () https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09 - Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/04/1 - Mailing List () http://www.openwall.com/lists/oss-security/2024/07/04/1 - Mailing List, Third Party Advisory
References () https://github.com/microsoft/azurelinux/issues/9555 - Issue Tracking () https://github.com/microsoft/azurelinux/issues/9555 - Issue Tracking, Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:4479 - () https://access.redhat.com/errata/RHSA-2024:4479 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2294604 - Issue Tracking () https://bugzilla.redhat.com/show_bug.cgi?id=2294604 - Issue Tracking, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/03/1 - Mailing List () http://www.openwall.com/lists/oss-security/2024/07/03/1 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/08/2 - () http://www.openwall.com/lists/oss-security/2024/07/08/2 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/23/4 - () http://www.openwall.com/lists/oss-security/2024/07/23/4 - Mailing List, Third Party Advisory
References () https://github.com/rapier1/hpn-ssh/issues/87 - Issue Tracking () https://github.com/rapier1/hpn-ssh/issues/87 - Issue Tracking, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/23/6 - () http://www.openwall.com/lists/oss-security/2024/07/23/6 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/09/2 - () http://www.openwall.com/lists/oss-security/2024/07/09/2 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/01/12 - Mailing List () http://www.openwall.com/lists/oss-security/2024/07/01/12 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/02/1 - Mailing List () http://www.openwall.com/lists/oss-security/2024/07/02/1 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/04/2 - Mailing List () http://www.openwall.com/lists/oss-security/2024/07/04/2 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/03/3 - Mailing List () http://www.openwall.com/lists/oss-security/2024/07/03/3 - Mailing List, Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:4469 - () https://access.redhat.com/errata/RHSA-2024:4469 - Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/01/13 - Mailing List () http://www.openwall.com/lists/oss-security/2024/07/01/13 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/08/3 - () http://www.openwall.com/lists/oss-security/2024/07/08/3 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/10/1 - () http://www.openwall.com/lists/oss-security/2024/07/10/1 - Mailing List, Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:4474 - () https://access.redhat.com/errata/RHSA-2024:4474 - Third Party Advisory
References () https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100 - () https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100 - Third Party Advisory
References () https://www.openssh.com/txt/release-9.8 - Release Notes () https://www.openssh.com/txt/release-9.8 - Release Notes, Third Party Advisory
References () https://github.com/AlmaLinux/updates/issues/629 - Issue Tracking () https://github.com/AlmaLinux/updates/issues/629 - Issue Tracking, Third Party Advisory
References () https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html - Mailing List, Patch () https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html - Mailing List, Patch, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/03/5 - Mailing List () http://www.openwall.com/lists/oss-security/2024/07/03/5 - Mailing List, Third Party Advisory
References () https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132 - () https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132 - Third Party Advisory
References () https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html - () https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:4340 - () https://access.redhat.com/errata/RHSA-2024:4340 - Third Party Advisory
References () https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/ - () https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/ - Mailing List, Third Party Advisory
References () https://github.com/oracle/oracle-linux/issues/149 - Issue Tracking () https://github.com/oracle/oracle-linux/issues/149 - Issue Tracking, Third Party Advisory
References () https://github.com/Azure/AKS/issues/4379 - Issue Tracking () https://github.com/Azure/AKS/issues/4379 - Issue Tracking, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/10/6 - () http://www.openwall.com/lists/oss-security/2024/07/10/6 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/10/4 - () http://www.openwall.com/lists/oss-security/2024/07/10/4 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/03/2 - Mailing List () http://www.openwall.com/lists/oss-security/2024/07/03/2 - Mailing List, Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:4389 - () https://access.redhat.com/errata/RHSA-2024:4389 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:4484 - () https://access.redhat.com/errata/RHSA-2024:4484 - Third Party Advisory
References () https://news.ycombinator.com/item?id=40843778 - Issue Tracking, Patch () https://news.ycombinator.com/item?id=40843778 - Issue Tracking, Patch, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/03/11 - Mailing List () http://www.openwall.com/lists/oss-security/2024/07/03/11 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/10/3 - () http://www.openwall.com/lists/oss-security/2024/07/10/3 - Mailing List, Third Party Advisory

23 Jul 2024, 22:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/23/6 -

23 Jul 2024, 21:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/23/4 -

18 Jul 2024, 22:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:4474 -

17 Jul 2024, 05:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:4479 -
  • () https://access.redhat.com/errata/RHSA-2024:4484 -

16 Jul 2024, 22:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:4469 -

14 Jul 2024, 17:15

Type Values Removed Values Added
Summary A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

11 Jul 2024, 20:15

Type Values Removed Values Added
References
  • () https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100 -

11 Jul 2024, 14:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/11/3 -

11 Jul 2024, 04:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/11/1 -
  • () https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09 -

10 Jul 2024, 23:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/10/6 -
  • () http://www.openwall.com/lists/oss-security/2024/07/10/4 -

10 Jul 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/10/3 -

10 Jul 2024, 17:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/10/1 -
  • () http://www.openwall.com/lists/oss-security/2024/07/10/2 -

10 Jul 2024, 01:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/09/5 -

09 Jul 2024, 12:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/09/2 -

09 Jul 2024, 06:15

Type Values Removed Values Added
References
  • () https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/ -
  • () https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do -

08 Jul 2024, 23:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:4389 -

08 Jul 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/08/3 -
  • () http://www.openwall.com/lists/oss-security/2024/07/08/2 -

06 Jul 2024, 05:15

Type Values Removed Values Added
References
  • () https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132 -
  • () https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html -

05 Jul 2024, 23:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:4340 -

05 Jul 2024, 15:53

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.1
CWE CWE-364 CWE-362
CPE cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p9:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p5:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:9.8:-:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p8:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:lts:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:p7:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:p5:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p4:*:*:*:*:*:*
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p3:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:-:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p6:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p11:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.1:-:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.3:p2:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.3:p3:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:22.10:*:*:*:-:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p10:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_micro:6.0:*:*:*:*:*:*:*
cpe:2.3:o:amazon:linux_2023:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.3:p1:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:*
cpe:2.3:o:netbsd:netbsd:*:*:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:8.5:p1:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:4.4:-:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p7:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:p6:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.2:p2:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.1:p1:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:*
cpe:2.3:o:freebsd:freebsd:13.3:-:*:*:*:*:*:*
References
  • () https://sig-security.rocky.page/issues/CVE-2024-6387/ - Third Party Advisory
References () https://github.com/PowerShell/Win32-OpenSSH/issues/2249 - () https://github.com/PowerShell/Win32-OpenSSH/issues/2249 - Issue Tracking
References () http://www.openwall.com/lists/oss-security/2024/07/03/4 - () http://www.openwall.com/lists/oss-security/2024/07/03/4 - Mailing List
References () https://explore.alas.aws.amazon.com/CVE-2024-6387.html - () https://explore.alas.aws.amazon.com/CVE-2024-6387.html - Third Party Advisory
References () https://ubuntu.com/security/CVE-2024-6387 - () https://ubuntu.com/security/CVE-2024-6387 - Third Party Advisory
References () https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 - () https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 - Issue Tracking
References () http://www.openwall.com/lists/oss-security/2024/07/04/1 - () http://www.openwall.com/lists/oss-security/2024/07/04/1 - Mailing List
References () https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/ - () https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/ - Third Party Advisory
References () https://github.com/microsoft/azurelinux/issues/9555 - () https://github.com/microsoft/azurelinux/issues/9555 - Issue Tracking
References () https://bugzilla.redhat.com/show_bug.cgi?id=2294604 - () https://bugzilla.redhat.com/show_bug.cgi?id=2294604 - Issue Tracking
References () https://github.com/zgzhang/cve-2024-6387-poc - () https://github.com/zgzhang/cve-2024-6387-poc - Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/03/1 - () http://www.openwall.com/lists/oss-security/2024/07/03/1 - Mailing List
References () https://github.com/rapier1/hpn-ssh/issues/87 - () https://github.com/rapier1/hpn-ssh/issues/87 - Issue Tracking
References () https://security.netapp.com/advisory/ntap-20240701-0001/ - () https://security.netapp.com/advisory/ntap-20240701-0001/ - Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/01/12 - () http://www.openwall.com/lists/oss-security/2024/07/01/12 - Mailing List
References () http://www.openwall.com/lists/oss-security/2024/07/02/1 - () http://www.openwall.com/lists/oss-security/2024/07/02/1 - Mailing List
References () https://access.redhat.com/errata/RHSA-2024:4312 - () https://access.redhat.com/errata/RHSA-2024:4312 - Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/04/2 - () http://www.openwall.com/lists/oss-security/2024/07/04/2 - Mailing List
References () http://www.openwall.com/lists/oss-security/2024/07/03/3 - () http://www.openwall.com/lists/oss-security/2024/07/03/3 - Mailing List
References () https://security-tracker.debian.org/tracker/CVE-2024-6387 - () https://security-tracker.debian.org/tracker/CVE-2024-6387 - Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/01/13 - () http://www.openwall.com/lists/oss-security/2024/07/01/13 - Mailing List
References () https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html - () https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html - Mailing List, Third Party Advisory
References () https://www.suse.com/security/cve/CVE-2024-6387.html - () https://www.suse.com/security/cve/CVE-2024-6387.html - Third Party Advisory
References () https://www.openssh.com/txt/release-9.8 - () https://www.openssh.com/txt/release-9.8 - Release Notes
References () https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc - () https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc - Third Party Advisory
References () https://github.com/AlmaLinux/updates/issues/629 - () https://github.com/AlmaLinux/updates/issues/629 - Issue Tracking
References () https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html - () https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html - Mailing List, Patch
References () http://www.openwall.com/lists/oss-security/2024/07/03/5 - () http://www.openwall.com/lists/oss-security/2024/07/03/5 - Mailing List
References () https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/ - () https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/ - Third Party Advisory
References () https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc - () https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc - Third Party Advisory
References () https://www.theregister.com/2024/07/01/regresshion_openssh/ - () https://www.theregister.com/2024/07/01/regresshion_openssh/ - Third Party Advisory
References () https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/ - () https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/ - Press/Media Coverage, Third Party Advisory
References () https://github.com/oracle/oracle-linux/issues/149 - () https://github.com/oracle/oracle-linux/issues/149 - Issue Tracking
References () https://github.com/Azure/AKS/issues/4379 - () https://github.com/Azure/AKS/issues/4379 - Issue Tracking
References () https://access.redhat.com/security/cve/CVE-2024-6387 - () https://access.redhat.com/security/cve/CVE-2024-6387 - Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/03/2 - () http://www.openwall.com/lists/oss-security/2024/07/03/2 - Mailing List
References () https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010 - () https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010 - Third Party Advisory
References () https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt - () https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt - Exploit, Third Party Advisory
References () https://news.ycombinator.com/item?id=40843778 - () https://news.ycombinator.com/item?id=40843778 - Issue Tracking, Patch
References () http://www.openwall.com/lists/oss-security/2024/07/03/11 - () http://www.openwall.com/lists/oss-security/2024/07/03/11 - Mailing List
References () https://ubuntu.com/security/notices/USN-6859-1 - () https://ubuntu.com/security/notices/USN-6859-1 - Third Party Advisory
References () https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server - () https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server - Exploit, Third Party Advisory
First Time Netapp e-series Santricity Os Controller
Redhat enterprise Linux For Arm 64 Eus
Redhat enterprise Linux For Power Little Endian Eus
Freebsd freebsd
Debian debian Linux
Redhat enterprise Linux For Ibm Z Systems
Freebsd
Redhat openshift Container Platform
Openbsd openssh
Canonical
Suse
Netapp
Redhat
Debian
Redhat enterprise Linux Server Aus
Suse linux Enterprise Micro
Netbsd netbsd
Netapp ontap Tools
Redhat enterprise Linux Eus
Netapp ontap Select Deploy Administration Utility
Amazon linux 2023
Canonical ubuntu Linux
Netbsd
Redhat enterprise Linux For Power Little Endian
Amazon
Redhat enterprise Linux For Arm 64
Openbsd
Redhat enterprise Linux
Redhat enterprise Linux For Ibm Z Systems Eus

04 Jul 2024, 12:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/04/2 -

04 Jul 2024, 03:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/04/1 -

03 Jul 2024, 22:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/03/11 -

03 Jul 2024, 20:15

Type Values Removed Values Added
References
  • () https://github.com/microsoft/azurelinux/issues/9555 -
  • () https://github.com/PowerShell/Win32-OpenSSH/issues/2249 -
  • () https://github.com/AlmaLinux/updates/issues/629 -
  • () https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 -
  • () https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/ -
  • () https://github.com/Azure/AKS/issues/4379 -

03 Jul 2024, 17:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:4312 -

03 Jul 2024, 13:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/03/4 -
  • () http://www.openwall.com/lists/oss-security/2024/07/03/5 -

03 Jul 2024, 09:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/03/3 -
  • () http://www.openwall.com/lists/oss-security/2024/07/03/1 -
  • () http://www.openwall.com/lists/oss-security/2024/07/03/2 -

02 Jul 2024, 23:15

Type Values Removed Values Added
Summary A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

02 Jul 2024, 19:15

Type Values Removed Values Added
References
  • () https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc -
  • () https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc -

02 Jul 2024, 14:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/02/1 -

01 Jul 2024, 23:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/01/13 -
  • () https://security.netapp.com/advisory/ntap-20240701-0001/ -

01 Jul 2024, 19:15

Type Values Removed Values Added
References
  • () https://explore.alas.aws.amazon.com/CVE-2024-6387.html -
  • () https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html -
  • () https://www.suse.com/security/cve/CVE-2024-6387.html -
  • () https://www.openssh.com/txt/release-9.8 -
  • () https://ubuntu.com/security/CVE-2024-6387 -
  • () https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html -
  • () https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/ -
  • () https://www.theregister.com/2024/07/01/regresshion_openssh/ -
  • () https://github.com/oracle/oracle-linux/issues/149 -
  • () https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/ -
  • () https://github.com/zgzhang/cve-2024-6387-poc -
  • () https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010 -
  • () https://github.com/rapier1/hpn-ssh/issues/87 -
  • () https://news.ycombinator.com/item?id=40843778 -
  • () https://ubuntu.com/security/notices/USN-6859-1 -
  • () https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server -
  • () https://security-tracker.debian.org/tracker/CVE-2024-6387 -

01 Jul 2024, 17:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/01/12 -

01 Jul 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-01 13:15

Updated : 2025-04-24 19:15

NVD link : CVE-2024-6387

Mitre link : CVE-2024-6387

JSON object : View

Products Affected

redhat

  • enterprise_linux_for_power_little_endian_eus
  • openshift_container_platform
  • enterprise_linux_for_arm_64
  • enterprise_linux_for_ibm_z_systems_eus
  • enterprise_linux_server_aus
  • enterprise_linux_for_arm_64_eus
  • enterprise_linux_for_ibm_z_systems
  • enterprise_linux_for_power_little_endian
  • enterprise_linux_eus
  • enterprise_linux

canonical

  • ubuntu_linux

netbsd

  • netbsd

openbsd

  • openssh

debian

  • debian_linux

netapp

  • e-series_santricity_os_controller
  • ontap_tools
  • ontap_select_deploy_administration_utility

freebsd

  • freebsd

amazon

  • linux_2023

suse

  • linux_enterprise_micro
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')