OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssh-keycatUpgrade openssh-clientsUpgrade openssh-serverUpgrade pam_ssh_agent_authUpgrade openssh-askpassUpgrade openssh | May 15, 2023 | Feb 3, 2023 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 3, 2023 |
| Centos_linux | — | Upgrade openssh-debuginfoUpgrade openssh-keycat-debuginfoUpgrade opensshUpgrade openssh-askpassUpgrade openssh-askpass-debuginfoUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-debugsourceUpgrade openssh-clientsUpgrade openssh-keycatUpgrade openssh-clients-debuginfoUpgrade openssh-sk-dummy-debuginfoUpgrade pam_ssh_agent_authUpgrade openssh-server-debuginfoUpgrade openssh-server | May 15, 2023 | Feb 3, 2023 |
| Debian | — | Upgrade openssh | Jul 30, 2024 | Feb 3, 2023 |
| Freebsd | — | Upgrade FreeBSD | Aug 31, 2023 | Aug 31, 2023 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Jul 20, 2023 | Feb 3, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade openssh-clientsUpgrade openssh-serverUpgrade openssh | May 18, 2023 | Feb 3, 2023 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 9.2 | Feb 13, 2023 | Feb 3, 2023 |
| Oracle_linux | — | Upgrade openssh-serverUpgrade pam_ssh_agent_authUpgrade opensshUpgrade openssh-askpassUpgrade openssh-clientsUpgrade openssh-keycat | May 18, 2023 | Feb 3, 2023 |
| Redhat_linux | — | Upgrade openssh-sk-dummy-debuginfoUpgrade openssh-askpass-debuginfoUpgrade openssh-askpassUpgrade openssh-debuginfoUpgrade openssh-clientsUpgrade opensshUpgrade openssh-server-debuginfoUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-keycatUpgrade pam_ssh_agent_authUpgrade openssh-clients-debuginfoUpgrade openssh-serverUpgrade openssh-debugsourceUpgrade openssh-keycat-debuginfo | May 15, 2023 | Feb 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub