OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssh-askpassUpgrade pam_ssh_agent_authUpgrade opensshUpgrade openssh-clientsUpgrade openssh-keycatUpgrade openssh-server | May 15, 2023 | Feb 3, 2023 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 3, 2023 |
| Centos_linux | — | Upgrade openssh-clientsUpgrade openssh-debuginfoUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-debugsourceUpgrade openssh-keycat-debuginfoUpgrade opensshUpgrade openssh-keycatUpgrade openssh-askpass-debuginfoUpgrade openssh-askpassUpgrade openssh-clients-debuginfoUpgrade openssh-sk-dummy-debuginfoUpgrade openssh-server-debuginfoUpgrade openssh-serverUpgrade pam_ssh_agent_auth | May 15, 2023 | Feb 3, 2023 |
| Debian | — | Upgrade openssh | Jul 30, 2024 | Feb 3, 2023 |
| Freebsd | — | Upgrade FreeBSD | Aug 31, 2023 | Aug 31, 2023 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Jul 20, 2023 | Feb 3, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade openssh-clientsUpgrade opensshUpgrade openssh-server | May 18, 2023 | Feb 3, 2023 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 9.2 | Feb 13, 2023 | Feb 3, 2023 |
| Oracle_linux | — | Upgrade opensshUpgrade openssh-askpassUpgrade openssh-serverUpgrade pam_ssh_agent_authUpgrade openssh-keycatUpgrade openssh-clients | May 18, 2023 | Feb 3, 2023 |
| Redhat_linux | — | Upgrade openssh-keycatUpgrade openssh-debugsourceUpgrade openssh-clients-debuginfoUpgrade pam_ssh_agent_authUpgrade openssh-serverUpgrade openssh-keycat-debuginfoUpgrade openssh-sk-dummy-debuginfoUpgrade opensshUpgrade openssh-server-debuginfoUpgrade openssh-clientsUpgrade openssh-debuginfoUpgrade openssh-askpass-debuginfoUpgrade openssh-askpassUpgrade pam_ssh_agent_auth-debuginfo | May 15, 2023 | Feb 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub