CVE-2024-6387
Openssh: regresshion - race condition in ssh allows rce/dos
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Openssh: regresshion - race condition in ssh allows rce/dos
| Assigner | redhat |
| Reserved | 2024-06-27 |
| Published | 2024-07-01 |
| Updated | 2024-09-14 |
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
| CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2024-06-27: | Reported to Red Hat. |
| 2024-07-01: | Made public. |
Red Hat would like to thank Qualys Threat Research Unit (TRU) (Qualys) for reporting this issue.
https://access.redhat.com/errata/RHSA-2024:4312 (RHSA-2024:4312)
https://access.redhat.com/errata/RHSA-2024:4340 (RHSA-2024:4340)
https://access.redhat.com/errata/RHSA-2024:4389 (RHSA-2024:4389)
https://access.redhat.com/errata/RHSA-2024:4469 (RHSA-2024:4469)
https://access.redhat.com/errata/RHSA-2024:4474 (RHSA-2024:4474)
https://access.redhat.com/errata/RHSA-2024:4479 (RHSA-2024:4479)
https://access.redhat.com/errata/RHSA-2024:4484 (RHSA-2024:4484)
https://access.redhat.com/security/cve/CVE-2024-6387
https://bugzilla.redhat.com/show_bug.cgi?id=2294604 (RHBZ#2294604)
https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
https://www.openssh.com/txt/release-9.8
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
