OpenSSH
Security incidents tagged OpenSSH. Newest first.
0 OpenSSH incidents in the last 12 months
- Incidents
- 2
- Live
- 0
- Patched
- 2
- Days without an incident
- 843
- Longest quiet run: 843 days (Jul 2–Oct 22)
Show 2 older incidents2 older incidents
July 2024 1
HighregreSSHion: unauthenticated RCE in OpenSSH sshd (CVE-2024-6387)Patched
OpenSSH sshd (glibc-based Linux) Patched
Qualys found a signal handler race condition in OpenSSH's sshd on glibc-based Linux that can give an unauthenticated attacker remote code execution as root. It is a regression of CVE-2006-5051 that came back in OpenSSH 8.5p1 (October 2020). Exploitation is difficult, but Qualys counted over 14 million potentially vulnerable internet-exposed servers. Fixed in OpenSSH 9.8p1.
Open incident →CVE-2024-6387
March 2024 1
- CriticalPatched
xz-utils backdoor (CVE-2024-3094)
A maintainer persona, 'Jia Tan', slipped a backdoor into the release tarballs of XZ Utils 5.6.0 and 5.6.1. Through liblzma it targeted OpenSSH's sshd on distributions that link sshd against libsystemd, so a key holder could get unauthenticated remote code execution. Andres Freund spotted it after noticing SSH logins using a lot of CPU on Debian sid. It reached only bleeding-edge distributions such as Fedora 41/Rawhide and Debian unstable before it was caught.
XZ Utils (liblzma)Closed May 29, 2024
