OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssh-keycatUpgrade openssh-clientsUpgrade openssh-serverUpgrade pam_ssh_agent_authUpgrade opensshUpgrade openssh-askpass | May 15, 2023 | Feb 3, 2023 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 3, 2023 |
| Centos_linux | — | Upgrade opensshUpgrade openssh-debuginfoUpgrade openssh-keycat-debuginfoUpgrade openssh-clientsUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-debugsourceUpgrade openssh-keycatUpgrade openssh-askpassUpgrade openssh-askpass-debuginfoUpgrade openssh-sk-dummy-debuginfoUpgrade openssh-clients-debuginfoUpgrade openssh-serverUpgrade pam_ssh_agent_authUpgrade openssh-server-debuginfo | May 15, 2023 | Feb 3, 2023 |
| Debian | — | Upgrade openssh | Jul 30, 2024 | Feb 3, 2023 |
| Freebsd | — | Upgrade FreeBSD | Aug 31, 2023 | Aug 31, 2023 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Jul 20, 2023 | Feb 3, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade openssh-clientsUpgrade openssh-serverUpgrade openssh | May 18, 2023 | Feb 3, 2023 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 9.2 | Feb 13, 2023 | Feb 3, 2023 |
| Oracle_linux | — | Upgrade openssh-keycatUpgrade openssh-clientsUpgrade openssh-serverUpgrade pam_ssh_agent_authUpgrade openssh-askpassUpgrade openssh | May 18, 2023 | Feb 3, 2023 |
| Redhat_linux | — | Upgrade openssh-keycatUpgrade openssh-keycat-debuginfoUpgrade openssh-clients-debuginfoUpgrade pam_ssh_agent_authUpgrade openssh-serverUpgrade openssh-debugsourceUpgrade opensshUpgrade openssh-clientsUpgrade openssh-askpassUpgrade openssh-debuginfoUpgrade openssh-server-debuginfoUpgrade openssh-askpass-debuginfoUpgrade openssh-sk-dummy-debuginfoUpgrade pam_ssh_agent_auth-debuginfo | May 15, 2023 | Feb 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub