OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssh-clientsUpgrade openssh-serverUpgrade openssh-keycatUpgrade openssh-askpassUpgrade opensshUpgrade pam_ssh_agent_auth | May 15, 2023 | Feb 3, 2023 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 3, 2023 |
| Centos_linux | — | Upgrade opensshUpgrade openssh-debuginfoUpgrade openssh-keycatUpgrade openssh-keycat-debuginfoUpgrade openssh-clientsUpgrade openssh-debugsourceUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-askpassUpgrade openssh-askpass-debuginfoUpgrade pam_ssh_agent_authUpgrade openssh-serverUpgrade openssh-server-debuginfoUpgrade openssh-sk-dummy-debuginfoUpgrade openssh-clients-debuginfo | May 15, 2023 | Feb 3, 2023 |
| Debian | — | Upgrade openssh | Jul 30, 2024 | Feb 3, 2023 |
| Freebsd | — | Upgrade FreeBSD | Aug 31, 2023 | Aug 31, 2023 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Jul 20, 2023 | Feb 3, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade openssh-clientsUpgrade openssh-serverUpgrade openssh | May 18, 2023 | Feb 3, 2023 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 9.2 | Feb 13, 2023 | Feb 3, 2023 |
| Oracle_linux | — | Upgrade pam_ssh_agent_authUpgrade openssh-keycatUpgrade openssh-clientsUpgrade openssh-serverUpgrade opensshUpgrade openssh-askpass | May 18, 2023 | Feb 3, 2023 |
| Redhat_linux | — | Upgrade openssh-sk-dummy-debuginfoUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-server-debuginfoUpgrade openssh-clientsUpgrade opensshUpgrade openssh-askpass-debuginfoUpgrade openssh-debuginfoUpgrade openssh-askpassUpgrade openssh-clients-debuginfoUpgrade pam_ssh_agent_authUpgrade openssh-keycatUpgrade openssh-debugsourceUpgrade openssh-serverUpgrade openssh-keycat-debuginfo | May 15, 2023 | Feb 3, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub