CVE-2024-6387
OpenSSH sshd Signal Handling Race Condition
Description
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
INFO
Published Date :
July 1, 2024, 1:15 p.m.
Last Modified :
Nov. 21, 2024, 9:49 a.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
5.9
Exploitability Score :
2.2
Public PoC/Exploit Available at Github
CVE-2024-6387 has a 156 public PoC/Exploit
available at Github.
Go to the Public Exploits
tab to see the list.
Affected Products
The following products are affected by CVE-2024-6387
vulnerability.
Even if cvefeed.io
is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-6387
.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
OpenSSH Vulnerabilities list
cve openssh vulnerabilities
Remote Unauthenticated Code Execution Vulnerability in OpenSSH server (CVE-2024-6387)
C Python
None
Thagarat (ثغرات) which literally means (vulnerabilities) in Arabic is a simple rust automation tool for the CVE DB Shodan API
automation hacking-tool information-gathering pentesting-tool pentesting-tools rust rust-lang shodan shodan-api cves-finder cybersecurity open-source security threat-intelligence inno-setup
Rust Inno Setup
News about technology and digital stuff
None
Python
Testing
Rust
In an era where digital security is crucial, a new vulnerability in OpenSSH, identified as CVE-2024-6387, has drawn the attention of system administrators and security professionals worldwide. Named "regreSSHion," this severe security flaw allows remote code execution (RCE) and could significant threat to the integrity of vulnerable systems.
This Python script checks for the CVE-2024-6387 vulnerability in OpenSSH servers. It supports multiple IP addresses, URLs, CIDR ranges, and ports. The script can also read addresses from a file.
Python
RCE OpenSSH CVE-2024-6387 Check and Exploit
C Python
bulk scanning tool for 21 different CVE's for OpenSSH
Python
OpenSSH Vulnerabilities Scanner: Bulk Scanning Tool for 21 different OpenSSH CVEs.
Python
DockerLab - Machine
A Bash script to mitigate the CVE-2024-6387 vulnerability in OpenSSH by providing an option to upgrade to a secure version or apply a temporary workaround. This repository helps secure systems against potential remote code execution risks associated with affected OpenSSH versions.
Shell
None
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-6387
vulnerability anywhere in the article.
- Cybersecurity News
Critical Vulnerabilities in Citrix Virtual Apps and Desktops Actively Exploited
Two vulnerabilities in Citrix’s “Virtual Apps and Desktops” remote access solution, CVE-2024-8068 and CVE-2024-8069, are actively being exploited in the wild, according to a report from Johannes B. Ul ... Read more
- Cybersecurity News
2023’s Most Exploited Vulnerabilities: A Global Cybersecurity Advisory
In a joint cybersecurity advisory, the top cybersecurity agencies from the United States, Australia, Canada, New Zealand, and the United Kingdom have identified the most exploited vulnerabilities of 2 ... Read more
- The Cyber Express
The Week’s Top Vulnerabilities: Cyble Urges Fixes for NVIDIA, Adobe, CUPS
Cyble researchers had a busy week, investigating 19 vulnerabilities in the week ended Oct.1 and flagging eight of them as high priority. Cyble’s weekly IT vulnerability report also noted that research ... Read more
- Cybersecurity News
Google Warns: Dependency Scanners Often Misreport Vulnerabilities
The AutoVM team at Google has discovered that dependency scanning tools often mistakenly report vulnerabilities in software. These vulnerabilities may either pose no real security threat or require no ... Read more
- Cybersecurity News
Citrix Workspace App Users Urged to Update Following Two Privilege Escalation Flaws
In a security advisory released recently, Cloud Software Group has disclosed two vulnerabilities affecting the widely used Citrix Workspace app for Windows. These vulnerabilities, identified as CVE-20 ... Read more
- cloudsecurityalliance.org
Return of the RCE: Addressing the regreSSHion Vulnerability – CVE-2024-6378
Originally published by Pentera. A Regrettable Resurgence On July 1, 2024, the Qualys Threat Research Unit (TRU) published their discovery of an unauthenticated remote code execution (RCE) vulnerabili ... Read more
- TheCyberThrone
FreeBSD Project fixes Critical Vulnerability CVE-2024-7589
The FreeBSD Project disclosed a critical vulnerability in OpenSSH, could allow a determined attacker to execute arbitrary code remotely with root privileges, potentially compromising the entire system ... Read more
- The Cyber Express
Critical OpenSSH Vulnerability in FreeBSD Allows Remote Root Access
A newly discovered OpenSSH vulnerability in FreeBSD systems has been reported. This critical flaw, identified as CVE-2024-7589, could allow attackers to execute remote code with root privileges withou ... Read more
- The Hacker News
FreeBSD Releases Urgent Patch for High-Severity OpenSSH Vulnerability
Cybersecurity / Network Security The maintainers of the FreeBSD Project have released security updates to address a high-severity flaw in OpenSSH that attackers could potentially exploit to execute ar ... Read more
- Cyber Security News
Critical OpenSSH Vulnerability in FreeBSD Let’s Attackers Gain Root Access Remotely
A critical security vulnerability has been discovered in OpenSSH implementations on FreeBSD systems, potentially allowing attackers to execute remote code without authentication. The vulnerability, id ... Read more
- Cybersecurity News
CVE-2024-7589: OpenSSH Pre-Authentication Vulnerability in FreeBSD Exposes Systems to RCE
Please enable JavaScriptIn a recent security advisory, the FreeBSD Project disclosed a critical vulnerability (CVE-2024-7589) in OpenSSH, the widely-used implementation of the SSH protocol suite. This ... Read more
- Cybersecurity News
CVE-2024-43044: Critical Jenkins Vulnerability Exposes Servers to RCE Attacks
Today, Jenkins, the popular open-source automation server, has issued an urgent advisory detailing two vulnerabilities, one with a critical severity rating. These vulnerabilities, identified as CVE-20 ... Read more
- TheCyberThrone
TheCyberThrone CyberSecurity Newsletter Top 5 Articles – July, 2024
Welcome to TheCyberThrone cybersecurity month in review will be posted covering the important security happenings . This review is for the month ending July, 2024Subscribers favorite #1RegreSSHion Vul ... Read more
- europa.eu
Cyber Security Brief 24-08 - July 2024
Cyber Brief (July 2024)August 1, 2024 - Version: 1.0TLP:CLEARExecutive summaryWe analysed 252 open source reports for this Cyber Security Brief1.Cyber policy and law enforcement efforts in Europe have ... Read more
- Kaspersky
Zero-day vulnerability in Internet Explorer | Kaspersky official blog
As part of its latest Patch Tuesday, Microsoft has released patches for 142 vulnerabilities. Among them were four zero-day vulnerabilities. While two of them were already publicly known, the other two ... Read more
- New Jetpack Site
Vulnerabilità regreSSHion in OpenSSH server
07/02/2024 N010724 CERT-Yoroi informa che è stata resa nota una vulnerabilità critica in OpenSSH server (sshd) nei sistemi Linux basati su glibc che consente ad utenti malintenzionati di eseguire del ... Read more
The following table lists the changes that have been made to the
CVE-2024-6387
vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference http://seclists.org/fulldisclosure/2024/Jul/18 Added Reference http://seclists.org/fulldisclosure/2024/Jul/19 Added Reference http://seclists.org/fulldisclosure/2024/Jul/20 Added Reference http://www.openwall.com/lists/oss-security/2024/07/01/12 Added Reference http://www.openwall.com/lists/oss-security/2024/07/01/13 Added Reference http://www.openwall.com/lists/oss-security/2024/07/02/1 Added Reference http://www.openwall.com/lists/oss-security/2024/07/03/1 Added Reference http://www.openwall.com/lists/oss-security/2024/07/03/11 Added Reference http://www.openwall.com/lists/oss-security/2024/07/03/2 Added Reference http://www.openwall.com/lists/oss-security/2024/07/03/3 Added Reference http://www.openwall.com/lists/oss-security/2024/07/03/4 Added Reference http://www.openwall.com/lists/oss-security/2024/07/03/5 Added Reference http://www.openwall.com/lists/oss-security/2024/07/04/1 Added Reference http://www.openwall.com/lists/oss-security/2024/07/04/2 Added Reference http://www.openwall.com/lists/oss-security/2024/07/08/2 Added Reference http://www.openwall.com/lists/oss-security/2024/07/08/3 Added Reference http://www.openwall.com/lists/oss-security/2024/07/09/2 Added Reference http://www.openwall.com/lists/oss-security/2024/07/09/5 Added Reference http://www.openwall.com/lists/oss-security/2024/07/10/1 Added Reference http://www.openwall.com/lists/oss-security/2024/07/10/2 Added Reference http://www.openwall.com/lists/oss-security/2024/07/10/3 Added Reference http://www.openwall.com/lists/oss-security/2024/07/10/4 Added Reference http://www.openwall.com/lists/oss-security/2024/07/10/6 Added Reference http://www.openwall.com/lists/oss-security/2024/07/11/1 Added Reference http://www.openwall.com/lists/oss-security/2024/07/11/3 Added Reference http://www.openwall.com/lists/oss-security/2024/07/23/4 Added Reference http://www.openwall.com/lists/oss-security/2024/07/23/6 Added Reference http://www.openwall.com/lists/oss-security/2024/07/28/2 Added Reference http://www.openwall.com/lists/oss-security/2024/07/28/3 Added Reference https://access.redhat.com/errata/RHSA-2024:4312 Added Reference https://access.redhat.com/errata/RHSA-2024:4340 Added Reference https://access.redhat.com/errata/RHSA-2024:4389 Added Reference https://access.redhat.com/errata/RHSA-2024:4469 Added Reference https://access.redhat.com/errata/RHSA-2024:4474 Added Reference https://access.redhat.com/errata/RHSA-2024:4479 Added Reference https://access.redhat.com/errata/RHSA-2024:4484 Added Reference https://access.redhat.com/security/cve/CVE-2024-6387 Added Reference https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/ Added Reference https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/ Added Reference https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2294604 Added Reference https://explore.alas.aws.amazon.com/CVE-2024-6387.html Added Reference https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132 Added Reference https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc Added Reference https://github.com/AlmaLinux/updates/issues/629 Added Reference https://github.com/Azure/AKS/issues/4379 Added Reference https://github.com/microsoft/azurelinux/issues/9555 Added Reference https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09 Added Reference https://github.com/oracle/oracle-linux/issues/149 Added Reference https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 Added Reference https://github.com/PowerShell/Win32-OpenSSH/issues/2249 Added Reference https://github.com/rapier1/hpn-ssh/issues/87 Added Reference https://github.com/zgzhang/cve-2024-6387-poc Added Reference https://lists.almalinux.org/archives/list/[email protected]/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/ Added Reference https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html Added Reference https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html Added Reference https://news.ycombinator.com/item?id=40843778 Added Reference https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010 Added Reference https://santandersecurityresearch.github.io/blog/sshing_the_masses.html Added Reference https://security.netapp.com/advisory/ntap-20240701-0001/ Added Reference https://security-tracker.debian.org/tracker/CVE-2024-6387 Added Reference https://sig-security.rocky.page/issues/CVE-2024-6387/ Added Reference https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/ Added Reference https://support.apple.com/kb/HT214118 Added Reference https://support.apple.com/kb/HT214119 Added Reference https://support.apple.com/kb/HT214120 Added Reference https://ubuntu.com/security/CVE-2024-6387 Added Reference https://ubuntu.com/security/notices/USN-6859-1 Added Reference https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do Added Reference https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100 Added Reference https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc Added Reference https://www.openssh.com/txt/release-9.8 Added Reference https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt Added Reference https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html Added Reference https://www.suse.com/security/cve/CVE-2024-6387.html Added Reference https://www.theregister.com/2024/07/01/regresshion_openssh/ Added Reference https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387 -
CVE Modified by [email protected]
Sep. 14, 2024
Action Type Old Value New Value Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/01/12 Removed Reference Red Hat, Inc. https://github.com/zgzhang/cve-2024-6387-poc Removed Reference Red Hat, Inc. https://ubuntu.com/security/CVE-2024-6387 Removed Reference Red Hat, Inc. https://ubuntu.com/security/notices/USN-6859-1 Removed Reference Red Hat, Inc. https://www.suse.com/security/cve/CVE-2024-6387.html Removed Reference Red Hat, Inc. https://explore.alas.aws.amazon.com/CVE-2024-6387.html Removed Reference Red Hat, Inc. https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/ Removed Reference Red Hat, Inc. https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html Removed Reference Red Hat, Inc. https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html Removed Reference Red Hat, Inc. https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server Removed Reference Red Hat, Inc. https://www.theregister.com/2024/07/01/regresshion_openssh/ Removed Reference Red Hat, Inc. https://news.ycombinator.com/item?id=40843778 Removed Reference Red Hat, Inc. https://security-tracker.debian.org/tracker/CVE-2024-6387 Removed Reference Red Hat, Inc. https://github.com/oracle/oracle-linux/issues/149 Removed Reference Red Hat, Inc. https://github.com/rapier1/hpn-ssh/issues/87 Removed Reference Red Hat, Inc. https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/ Removed Reference Red Hat, Inc. https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/01/13 Removed Reference Red Hat, Inc. https://security.netapp.com/advisory/ntap-20240701-0001/ Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/02/1 Removed Reference Red Hat, Inc. https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc Removed Reference Red Hat, Inc. https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/2 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/1 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/3 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/4 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/5 Removed Reference Red Hat, Inc. https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/ Removed Reference Red Hat, Inc. https://github.com/microsoft/azurelinux/issues/9555 Removed Reference Red Hat, Inc. https://github.com/Azure/AKS/issues/4379 Removed Reference Red Hat, Inc. https://github.com/PowerShell/Win32-OpenSSH/issues/2249 Removed Reference Red Hat, Inc. https://github.com/AlmaLinux/updates/issues/629 Removed Reference Red Hat, Inc. https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/11 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/04/1 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/04/2 Removed Reference Red Hat, Inc. https://sig-security.rocky.page/issues/CVE-2024-6387/ Removed Reference Red Hat, Inc. https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html Removed Reference Red Hat, Inc. https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/08/2 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/08/3 Removed Reference Red Hat, Inc. https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do Removed Reference Red Hat, Inc. https://lists.almalinux.org/archives/list/[email protected]/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/ Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/09/2 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/09/5 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/10/1 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/10/2 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/10/3 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/10/4 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/10/6 Removed Reference Red Hat, Inc. https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/11/1 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/11/3 Removed Reference Red Hat, Inc. https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/23/4 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/23/6 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/28/2 Removed Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/28/3 Removed Reference Red Hat, Inc. https://support.apple.com/kb/HT214119 Removed Reference Red Hat, Inc. https://support.apple.com/kb/HT214118 Removed Reference Red Hat, Inc. https://support.apple.com/kb/HT214120 Removed Reference Red Hat, Inc. http://seclists.org/fulldisclosure/2024/Jul/20 Removed Reference Red Hat, Inc. http://seclists.org/fulldisclosure/2024/Jul/18 Removed Reference Red Hat, Inc. http://seclists.org/fulldisclosure/2024/Jul/19 -
CVE Modified by [email protected]
Jul. 30, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://seclists.org/fulldisclosure/2024/Jul/18 [No types assigned] Added Reference Red Hat, Inc. http://seclists.org/fulldisclosure/2024/Jul/19 [No types assigned] -
CVE Modified by [email protected]
Jul. 30, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://seclists.org/fulldisclosure/2024/Jul/20 [No types assigned] -
CVE Modified by [email protected]
Jul. 29, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://support.apple.com/kb/HT214119 [No types assigned] Added Reference Red Hat, Inc. https://support.apple.com/kb/HT214118 [No types assigned] Added Reference Red Hat, Inc. https://support.apple.com/kb/HT214120 [No types assigned] -
CVE Modified by [email protected]
Jul. 29, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://santandersecurityresearch.github.io/blog/sshing_the_masses.html [No types assigned] -
CVE Modified by [email protected]
Jul. 28, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/28/2 [No types assigned] Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/28/3 [No types assigned] -
Modified Analysis by [email protected]
Jul. 24, 2024
Action Type Old Value New Value Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/01/12 Mailing List http://www.openwall.com/lists/oss-security/2024/07/01/12 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/01/13 Mailing List http://www.openwall.com/lists/oss-security/2024/07/01/13 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/02/1 Mailing List http://www.openwall.com/lists/oss-security/2024/07/02/1 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/03/1 Mailing List http://www.openwall.com/lists/oss-security/2024/07/03/1 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/03/11 Mailing List http://www.openwall.com/lists/oss-security/2024/07/03/11 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/03/2 Mailing List http://www.openwall.com/lists/oss-security/2024/07/03/2 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/03/3 Mailing List http://www.openwall.com/lists/oss-security/2024/07/03/3 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/03/4 Mailing List http://www.openwall.com/lists/oss-security/2024/07/03/4 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/03/5 Mailing List http://www.openwall.com/lists/oss-security/2024/07/03/5 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/04/1 Mailing List http://www.openwall.com/lists/oss-security/2024/07/04/1 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/04/2 Mailing List http://www.openwall.com/lists/oss-security/2024/07/04/2 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/08/2 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/08/2 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/08/3 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/08/3 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/09/2 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/09/2 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/09/5 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/09/5 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/10/1 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/10/1 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/10/2 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/10/2 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/10/3 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/10/3 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/10/4 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/10/4 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/10/6 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/10/6 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/11/1 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/11/1 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/11/3 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/11/3 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/23/4 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/23/4 Mailing List, Third Party Advisory Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/23/6 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/23/6 Mailing List, Third Party Advisory Changed Reference Type https://access.redhat.com/errata/RHSA-2024:4340 No Types Assigned https://access.redhat.com/errata/RHSA-2024:4340 Third Party Advisory Changed Reference Type https://access.redhat.com/errata/RHSA-2024:4389 No Types Assigned https://access.redhat.com/errata/RHSA-2024:4389 Third Party Advisory Changed Reference Type https://access.redhat.com/errata/RHSA-2024:4469 No Types Assigned https://access.redhat.com/errata/RHSA-2024:4469 Third Party Advisory Changed Reference Type https://access.redhat.com/errata/RHSA-2024:4474 No Types Assigned https://access.redhat.com/errata/RHSA-2024:4474 Third Party Advisory Changed Reference Type https://access.redhat.com/errata/RHSA-2024:4479 No Types Assigned https://access.redhat.com/errata/RHSA-2024:4479 Third Party Advisory Changed Reference Type https://access.redhat.com/errata/RHSA-2024:4484 No Types Assigned https://access.redhat.com/errata/RHSA-2024:4484 Third Party Advisory Changed Reference Type https://bugzilla.redhat.com/show_bug.cgi?id=2294604 Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2294604 Issue Tracking, Third Party Advisory Changed Reference Type https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132 No Types Assigned https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132 Third Party Advisory Changed Reference Type https://github.com/AlmaLinux/updates/issues/629 Issue Tracking https://github.com/AlmaLinux/updates/issues/629 Issue Tracking, Third Party Advisory Changed Reference Type https://github.com/Azure/AKS/issues/4379 Issue Tracking https://github.com/Azure/AKS/issues/4379 Issue Tracking, Third Party Advisory Changed Reference Type https://github.com/microsoft/azurelinux/issues/9555 Issue Tracking https://github.com/microsoft/azurelinux/issues/9555 Issue Tracking, Third Party Advisory Changed Reference Type https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09 No Types Assigned https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09 Third Party Advisory Changed Reference Type https://github.com/oracle/oracle-linux/issues/149 Issue Tracking https://github.com/oracle/oracle-linux/issues/149 Issue Tracking, Third Party Advisory Changed Reference Type https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 Issue Tracking https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 Issue Tracking, Third Party Advisory Changed Reference Type https://github.com/PowerShell/Win32-OpenSSH/issues/2249 Issue Tracking https://github.com/PowerShell/Win32-OpenSSH/issues/2249 Issue Tracking, Third Party Advisory Changed Reference Type https://github.com/rapier1/hpn-ssh/issues/87 Issue Tracking https://github.com/rapier1/hpn-ssh/issues/87 Issue Tracking, Third Party Advisory Changed Reference Type https://lists.almalinux.org/archives/list/[email protected]/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/ No Types Assigned https://lists.almalinux.org/archives/list/[email protected]/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/ Mailing List, Third Party Advisory Changed Reference Type https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html Mailing List, Patch https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html Mailing List, Patch, Third Party Advisory Changed Reference Type https://news.ycombinator.com/item?id=40843778 Issue Tracking, Patch https://news.ycombinator.com/item?id=40843778 Issue Tracking, Patch, Third Party Advisory Changed Reference Type https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do No Types Assigned https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do Third Party Advisory Changed Reference Type https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100 No Types Assigned https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100 Third Party Advisory Changed Reference Type https://www.openssh.com/txt/release-9.8 Release Notes https://www.openssh.com/txt/release-9.8 Release Notes, Third Party Advisory Changed Reference Type https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html No Types Assigned https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html Third Party Advisory Changed CPE Configuration OR *cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* versions up to (excluding) 4.4 *cpe:2.3:a:openbsd:openssh:4.4:-:*:*:*:*:*:* *cpe:2.3:a:openbsd:openssh:8.5:p1:*:*:*:*:*:* *cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* versions from (including) 8.6 up to (excluding) 9.8 *cpe:2.3:a:openbsd:openssh:9.8:-:*:*:*:*:*:* OR *cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* versions up to (excluding) 4.4 *cpe:2.3:a:openbsd:openssh:4.4:-:*:*:*:*:*:* *cpe:2.3:a:openbsd:openssh:8.5:p1:*:*:*:*:*:* *cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* versions from (including) 8.6 up to (excluding) 9.8 -
CVE Modified by [email protected]
Jul. 23, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/23/6 [No types assigned] -
CVE Modified by [email protected]
Jul. 23, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/23/4 [No types assigned] -
CVE Modified by [email protected]
Jul. 18, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://access.redhat.com/errata/RHSA-2024:4474 [No types assigned] -
CVE Modified by [email protected]
Jul. 17, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://access.redhat.com/errata/RHSA-2024:4479 [No types assigned] Added Reference Red Hat, Inc. https://access.redhat.com/errata/RHSA-2024:4484 [No types assigned] -
CVE Modified by [email protected]
Jul. 16, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://access.redhat.com/errata/RHSA-2024:4469 [No types assigned] -
CVE Modified by [email protected]
Jul. 14, 2024
Action Type Old Value New Value Changed Description A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. -
CVE Modified by [email protected]
Jul. 11, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100 [No types assigned] -
CVE Modified by [email protected]
Jul. 11, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/11/3 [No types assigned] -
CVE Modified by [email protected]
Jul. 11, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/11/1 [No types assigned] -
CVE Modified by [email protected]
Jul. 11, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09 [No types assigned] -
CVE Modified by [email protected]
Jul. 10, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/10/6 [No types assigned] -
CVE Modified by [email protected]
Jul. 10, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/10/4 [No types assigned] -
CVE Modified by [email protected]
Jul. 10, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/10/3 [No types assigned] -
CVE Modified by [email protected]
Jul. 10, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/10/2 [No types assigned] -
CVE Modified by [email protected]
Jul. 10, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/10/1 [No types assigned] -
CVE Modified by [email protected]
Jul. 10, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/09/5 [No types assigned] -
CVE Modified by [email protected]
Jul. 09, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/09/2 [No types assigned] -
CVE Modified by [email protected]
Jul. 09, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do [No types assigned] Added Reference Red Hat, Inc. https://lists.almalinux.org/archives/list/[email protected]/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/ [No types assigned] -
CVE Modified by [email protected]
Jul. 08, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://access.redhat.com/errata/RHSA-2024:4389 [No types assigned] -
CVE Modified by [email protected]
Jul. 08, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/08/2 [No types assigned] Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/08/3 [No types assigned] -
CVE Modified by [email protected]
Jul. 06, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html [No types assigned] Added Reference Red Hat, Inc. https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132 [No types assigned] -
CVE Modified by [email protected]
Jul. 05, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://access.redhat.com/errata/RHSA-2024:4340 [No types assigned] -
Modified Analysis by [email protected]
Jul. 05, 2024
Action Type Old Value New Value Changed Reference Type https://sig-security.rocky.page/issues/CVE-2024-6387/ No Types Assigned https://sig-security.rocky.page/issues/CVE-2024-6387/ Third Party Advisory -
CVE Modified by [email protected]
Jul. 05, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://sig-security.rocky.page/issues/CVE-2024-6387/ [No types assigned] -
Initial Analysis by [email protected]
Jul. 05, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/01/12 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/01/12 Mailing List Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/01/13 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/01/13 Mailing List Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/02/1 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/02/1 Mailing List Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/03/1 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/03/1 Mailing List Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/03/11 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/03/11 Mailing List Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/03/2 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/03/2 Mailing List Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/03/3 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/03/3 Mailing List Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/03/4 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/03/4 Mailing List Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/03/5 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/03/5 Mailing List Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/04/1 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/04/1 Mailing List Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/04/2 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/04/2 Mailing List Changed Reference Type https://access.redhat.com/errata/RHSA-2024:4312 No Types Assigned https://access.redhat.com/errata/RHSA-2024:4312 Third Party Advisory Changed Reference Type https://access.redhat.com/security/cve/CVE-2024-6387 No Types Assigned https://access.redhat.com/security/cve/CVE-2024-6387 Third Party Advisory Changed Reference Type https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/ No Types Assigned https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/ Third Party Advisory Changed Reference Type https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/ No Types Assigned https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/ Press/Media Coverage, Third Party Advisory Changed Reference Type https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server No Types Assigned https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server Exploit, Third Party Advisory Changed Reference Type https://bugzilla.redhat.com/show_bug.cgi?id=2294604 No Types Assigned https://bugzilla.redhat.com/show_bug.cgi?id=2294604 Issue Tracking Changed Reference Type https://explore.alas.aws.amazon.com/CVE-2024-6387.html No Types Assigned https://explore.alas.aws.amazon.com/CVE-2024-6387.html Third Party Advisory Changed Reference Type https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc No Types Assigned https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc Third Party Advisory Changed Reference Type https://github.com/AlmaLinux/updates/issues/629 No Types Assigned https://github.com/AlmaLinux/updates/issues/629 Issue Tracking Changed Reference Type https://github.com/Azure/AKS/issues/4379 No Types Assigned https://github.com/Azure/AKS/issues/4379 Issue Tracking Changed Reference Type https://github.com/microsoft/azurelinux/issues/9555 No Types Assigned https://github.com/microsoft/azurelinux/issues/9555 Issue Tracking Changed Reference Type https://github.com/oracle/oracle-linux/issues/149 No Types Assigned https://github.com/oracle/oracle-linux/issues/149 Issue Tracking Changed Reference Type https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 No Types Assigned https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 Issue Tracking Changed Reference Type https://github.com/PowerShell/Win32-OpenSSH/issues/2249 No Types Assigned https://github.com/PowerShell/Win32-OpenSSH/issues/2249 Issue Tracking Changed Reference Type https://github.com/rapier1/hpn-ssh/issues/87 No Types Assigned https://github.com/rapier1/hpn-ssh/issues/87 Issue Tracking Changed Reference Type https://github.com/zgzhang/cve-2024-6387-poc No Types Assigned https://github.com/zgzhang/cve-2024-6387-poc Third Party Advisory Changed Reference Type https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html No Types Assigned https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html Mailing List, Third Party Advisory Changed Reference Type https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html No Types Assigned https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html Mailing List, Patch Changed Reference Type https://news.ycombinator.com/item?id=40843778 No Types Assigned https://news.ycombinator.com/item?id=40843778 Issue Tracking, Patch Changed Reference Type https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010 No Types Assigned https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010 Third Party Advisory Changed Reference Type https://security.netapp.com/advisory/ntap-20240701-0001/ No Types Assigned https://security.netapp.com/advisory/ntap-20240701-0001/ Third Party Advisory Changed Reference Type https://security-tracker.debian.org/tracker/CVE-2024-6387 No Types Assigned https://security-tracker.debian.org/tracker/CVE-2024-6387 Third Party Advisory Changed Reference Type https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/ No Types Assigned https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/ Third Party Advisory Changed Reference Type https://ubuntu.com/security/CVE-2024-6387 No Types Assigned https://ubuntu.com/security/CVE-2024-6387 Third Party Advisory Changed Reference Type https://ubuntu.com/security/notices/USN-6859-1 No Types Assigned https://ubuntu.com/security/notices/USN-6859-1 Third Party Advisory Changed Reference Type https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc No Types Assigned https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc Third Party Advisory Changed Reference Type https://www.openssh.com/txt/release-9.8 No Types Assigned https://www.openssh.com/txt/release-9.8 Release Notes Changed Reference Type https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt No Types Assigned https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt Exploit, Third Party Advisory Changed Reference Type https://www.suse.com/security/cve/CVE-2024-6387.html No Types Assigned https://www.suse.com/security/cve/CVE-2024-6387.html Third Party Advisory Changed Reference Type https://www.theregister.com/2024/07/01/regresshion_openssh/ No Types Assigned https://www.theregister.com/2024/07/01/regresshion_openssh/ Third Party Advisory Added CWE NIST CWE-362 Added CPE Configuration OR *cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* versions up to (excluding) 4.4 *cpe:2.3:a:openbsd:openssh:4.4:-:*:*:*:*:*:* *cpe:2.3:a:openbsd:openssh:8.5:p1:*:*:*:*:*:* *cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* versions from (including) 8.6 up to (excluding) 9.8 *cpe:2.3:a:openbsd:openssh:9.8:-:*:*:*:*:*:* Added CPE Configuration OR *cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:* Added CPE Configuration OR *cpe:2.3:o:suse:linux_enterprise_micro:6.0:*:*:*:*:*:*:* Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Added CPE Configuration OR *cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:22.10:*:*:*:-:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:lts:*:*:* Added CPE Configuration OR *cpe:2.3:o:amazon:linux_2023:-:*:*:*:*:*:*:* Added CPE Configuration OR *cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* versions from (including) 11.0.0 up to (including) 11.70.2 *cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* *cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:* Added CPE Configuration OR *cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:13.2:p10:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:13.2:p11:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:13.2:p2:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:13.2:p3:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:13.2:p4:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:13.2:p5:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:13.2:p6:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:13.2:p7:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:13.2:p8:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:13.2:p9:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:13.3:-:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:13.3:p1:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:13.3:p2:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:13.3:p3:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.0:-:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.0:p5:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.0:p6:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.0:p7:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.1:-:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.1:p1:*:*:*:*:*:* Added CPE Configuration OR *cpe:2.3:o:netbsd:netbsd:*:*:*:*:*:*:*:* versions up to (including) 10.0.0 -
CVE Modified by [email protected]
Jul. 04, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/04/2 [No types assigned] -
CVE Modified by [email protected]
Jul. 04, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/04/1 [No types assigned] -
CVE Modified by [email protected]
Jul. 03, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/11 [No types assigned] -
CVE Modified by [email protected]
Jul. 03, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/ [No types assigned] Added Reference Red Hat, Inc. https://github.com/microsoft/azurelinux/issues/9555 [No types assigned] Added Reference Red Hat, Inc. https://github.com/Azure/AKS/issues/4379 [No types assigned] Added Reference Red Hat, Inc. https://github.com/PowerShell/Win32-OpenSSH/issues/2249 [No types assigned] Added Reference Red Hat, Inc. https://github.com/AlmaLinux/updates/issues/629 [No types assigned] Added Reference Red Hat, Inc. https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 [No types assigned] -
CVE Modified by [email protected]
Jul. 03, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://access.redhat.com/errata/RHSA-2024:4312 [No types assigned] -
CVE Modified by [email protected]
Jul. 03, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/5 [No types assigned] -
CVE Modified by [email protected]
Jul. 03, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/4 [No types assigned] -
CVE Modified by [email protected]
Jul. 03, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/3 [No types assigned] -
CVE Modified by [email protected]
Jul. 03, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/2 [No types assigned] Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/1 [No types assigned] -
CVE Modified by [email protected]
Jul. 02, 2024
Action Type Old Value New Value Changed Description A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. -
CVE Modified by [email protected]
Jul. 02, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc [No types assigned] Added Reference Red Hat, Inc. https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc [No types assigned] -
CVE Modified by [email protected]
Jul. 02, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/02/1 [No types assigned] -
CVE Modified by [email protected]
Jul. 01, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://security.netapp.com/advisory/ntap-20240701-0001/ [No types assigned] -
CVE Modified by [email protected]
Jul. 01, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/01/13 [No types assigned] -
CVE Modified by [email protected]
Jul. 01, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/ [No types assigned] Added Reference Red Hat, Inc. https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010 [No types assigned] -
CVE Modified by [email protected]
Jul. 01, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. https://github.com/zgzhang/cve-2024-6387-poc [No types assigned] Added Reference Red Hat, Inc. https://ubuntu.com/security/CVE-2024-6387 [No types assigned] Added Reference Red Hat, Inc. https://ubuntu.com/security/notices/USN-6859-1 [No types assigned] Added Reference Red Hat, Inc. https://www.suse.com/security/cve/CVE-2024-6387.html [No types assigned] Added Reference Red Hat, Inc. https://explore.alas.aws.amazon.com/CVE-2024-6387.html [No types assigned] Added Reference Red Hat, Inc. https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/ [No types assigned] Added Reference Red Hat, Inc. https://www.openssh.com/txt/release-9.8 [No types assigned] Added Reference Red Hat, Inc. https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html [No types assigned] Added Reference Red Hat, Inc. https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html [No types assigned] Added Reference Red Hat, Inc. https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server [No types assigned] Added Reference Red Hat, Inc. https://www.theregister.com/2024/07/01/regresshion_openssh/ [No types assigned] Added Reference Red Hat, Inc. https://news.ycombinator.com/item?id=40843778 [No types assigned] Added Reference Red Hat, Inc. https://security-tracker.debian.org/tracker/CVE-2024-6387 [No types assigned] Added Reference Red Hat, Inc. https://github.com/oracle/oracle-linux/issues/149 [No types assigned] Added Reference Red Hat, Inc. https://github.com/rapier1/hpn-ssh/issues/87 [No types assigned] -
CVE Modified by [email protected]
Jul. 01, 2024
Action Type Old Value New Value Added Reference Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/01/12 [No types assigned] -
CVE Received by [email protected]
Jul. 01, 2024
Action Type Old Value New Value Added Description A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). Added Reference Red Hat, Inc. https://access.redhat.com/security/cve/CVE-2024-6387 [No types assigned] Added Reference Red Hat, Inc. https://bugzilla.redhat.com/show_bug.cgi?id=2294604 [No types assigned] Added Reference Red Hat, Inc. https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt [No types assigned] Added CWE Red Hat, Inc. CWE-364 Added CVSS V3.1 Red Hat, Inc. AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-6387
is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-6387
weaknesses.