OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssh-askpassUpgrade opensshUpgrade pam_ssh_agent_authUpgrade openssh-clientsUpgrade openssh-keycatUpgrade openssh-server | May 15, 2023 | Feb 3, 2023 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 3, 2023 |
| Centos_linux | — | Upgrade opensshUpgrade openssh-keycat-debuginfoUpgrade openssh-debuginfoUpgrade openssh-askpassUpgrade openssh-askpass-debuginfoUpgrade openssh-debugsourceUpgrade openssh-clientsUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-keycatUpgrade openssh-sk-dummy-debuginfoUpgrade openssh-clients-debuginfoUpgrade openssh-serverUpgrade pam_ssh_agent_authUpgrade openssh-server-debuginfo | May 15, 2023 | Feb 3, 2023 |
| Debian | — | Upgrade openssh | Jul 30, 2024 | Feb 3, 2023 |
| Freebsd | — | Upgrade FreeBSD | Aug 31, 2023 | Aug 31, 2023 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Jul 20, 2023 | Feb 3, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade openssh-clientsUpgrade openssh-serverUpgrade openssh | May 18, 2023 | Feb 3, 2023 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 9.2 | Feb 13, 2023 | Feb 3, 2023 |
| Oracle_linux | — | Upgrade pam_ssh_agent_authUpgrade opensshUpgrade openssh-serverUpgrade openssh-askpassUpgrade openssh-keycatUpgrade openssh-clients | May 18, 2023 | Feb 3, 2023 |
| Redhat_linux | — | Upgrade openssh-debuginfoUpgrade openssh-sk-dummy-debuginfoUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-askpass-debuginfoUpgrade opensshUpgrade openssh-clientsUpgrade openssh-server-debuginfoUpgrade openssh-askpassUpgrade pam_ssh_agent_authUpgrade openssh-clients-debuginfoUpgrade openssh-debugsourceUpgrade openssh-keycat-debuginfoUpgrade openssh-serverUpgrade openssh-keycat | May 15, 2023 | Feb 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub