{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T18:54:42.548Z",
  "tag": {
    "id": "openssh",
    "label": "OpenSSH",
    "isStack": false,
    "url": "https://pwn.watch/t/openssh",
    "feed": "https://pwn.watch/t/openssh/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "openssh-regresshion-cve-2024-6387",
      "title": "regreSSHion: unauthenticated RCE in OpenSSH sshd (CVE-2024-6387)",
      "url": "https://pwn.watch/i/openssh-regresshion-cve-2024-6387",
      "json": "https://pwn.watch/i/openssh-regresshion-cve-2024-6387.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "OpenSSH sshd (glibc-based Linux)",
      "tags": [
        "linux",
        "openssh",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-6387"
      ],
      "affectedVersions": [
        "8.5p1 up to (not including) 9.8p1",
        "Versions before 4.4p1 unless patched for CVE-2006-5051 and CVE-2008-4109 (Qualys)"
      ],
      "fixedVersions": [
        "9.8p1"
      ],
      "startedAt": "2024-07-01",
      "closedAt": "2024-07-01",
      "updatedAt": "2024-07-01",
      "summary": "Qualys found a signal handler race condition in OpenSSH's sshd on glibc-based Linux that can give an unauthenticated attacker remote code execution as root. It is a regression of CVE-2006-5051 that came back in OpenSSH 8.5p1 (October 2020). Exploitation is difficult, but Qualys counted over 14 million potentially vulnerable internet-exposed servers. Fixed in OpenSSH 9.8p1.",
      "xPost": null
    },
    {
      "slug": "xz-utils-backdoor-cve-2024-3094",
      "title": "xz-utils backdoor (CVE-2024-3094)",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094",
      "json": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "XZ Utils (liblzma)",
      "tags": [
        "linux",
        "xz-utils",
        "openssh",
        "supply-chain",
        "backdoor",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-3094"
      ],
      "affectedVersions": [
        "5.6.0",
        "5.6.1"
      ],
      "fixedVersions": [
        "Downgrade to an uncompromised version such as 5.4.6 Stable (CISA)",
        "5.6.2 clean release (2024-05-29, tukaani.org)"
      ],
      "startedAt": "2024-03-29",
      "closedAt": "2024-05-29",
      "updatedAt": "2024-05-29",
      "summary": "A maintainer persona, 'Jia Tan', slipped a backdoor into the release tarballs of XZ Utils 5.6.0 and 5.6.1. Through liblzma it targeted OpenSSH's sshd on distributions that link sshd against libsystemd, so a key holder could get unauthenticated remote code execution. Andres Freund spotted it after noticing SSH logins using a lot of CPU on Debian sid. It reached only bleeding-edge distributions such as Fedora 41/Rawhide and Debian unstable before it was caught.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "openssh-regresshion-cve-2024-6387",
      "incidentTitle": "regreSSHion: unauthenticated RCE in OpenSSH sshd (CVE-2024-6387)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-07-01",
      "title": "Qualys discloses regreSSHion; OpenSSH 9.8p1 released with the fix",
      "body": null,
      "sourceUrl": "https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server",
      "url": "https://pwn.watch/i/openssh-regresshion-cve-2024-6387"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-05-29",
      "title": "Lasse Collin publishes review notes 1.0 and new clean XZ Utils releases",
      "body": null,
      "sourceUrl": "https://tukaani.org/xz-backdoor/",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-09",
      "title": "XZ Git repositories available on GitHub again",
      "body": null,
      "sourceUrl": "https://tukaani.org/xz-backdoor/",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-30",
      "title": "xz@tukaani.org stops forwarding to Jia Tan",
      "body": null,
      "sourceUrl": "https://tukaani.org/xz-backdoor/",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-29",
      "title": "Andres Freund discloses the backdoor on oss-security",
      "body": null,
      "sourceUrl": "https://www.openwall.com/lists/oss-security/2024/03/29/4",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-29",
      "title": "CISA alert: downgrade XZ Utils to an uncompromised version such as 5.4.6",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-29",
      "title": "Red Hat urgent security alert for Fedora 41 and Rawhide users",
      "body": null,
      "sourceUrl": "https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    }
  ]
}