The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-opensshalma-upgrade-openssh-askpassalma-upgrade-openssh-cavsalma-upgrade-openssh-clientsalma-upgrade-openssh-keycatalma-upgrade-openssh-ldapalma-upgrade-openssh-serveralma-upgrade-pam_ssh_agent_auth | Aug 3, 2023 | Jul 20, 2023 | |
| Alpine Linux | alpine-linux-upgrade-openssh | Mar 26, 2024 | Jul 20, 2023 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-opensshamazon-linux-ami-2-upgrade-openssh-askpassamazon-linux-ami-2-upgrade-openssh-cavsamazon-linux-ami-2-upgrade-openssh-clientsamazon-linux-ami-2-upgrade-openssh-debuginfoamazon-linux-ami-2-upgrade-openssh-keycatamazon-linux-ami-2-upgrade-openssh-ldapamazon-linux-ami-2-upgrade-openssh-serveramazon-linux-ami-2-upgrade-openssh-server-sysvinitamazon-linux-ami-2-upgrade-pam_ssh_agent_auth | Aug 9, 2023 | Jul 20, 2023 | |
| Amazon_linux | — | amazon-linux-upgrade-openssh | Aug 23, 2023 | Jul 20, 2023 |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-opensshamazon-linux-2023-upgrade-openssh-clientsamazon-linux-2023-upgrade-openssh-clients-debuginfoamazon-linux-2023-upgrade-openssh-debuginfoamazon-linux-2023-upgrade-openssh-debugsourceamazon-linux-2023-upgrade-openssh-keycatamazon-linux-2023-upgrade-openssh-keycat-debuginfoamazon-linux-2023-upgrade-openssh-serveramazon-linux-2023-upgrade-openssh-server-debuginfoamazon-linux-2023-upgrade-pam-ssh-agent-authamazon-linux-2023-upgrade-pam-ssh-agent-auth-debuginfo | Feb 17, 2025 | Jul 19, 2023 | |
| Apple Osx Openssh | apple-osx-upgrade-latest | Dec 27, 2023 | Jul 20, 2023 | |
| Centos_linux | — | centos-upgrade-opensshcentos-upgrade-openssh-askpasscentos-upgrade-openssh-cavscentos-upgrade-openssh-clientscentos-upgrade-openssh-debuginfocentos-upgrade-openssh-keycatcentos-upgrade-openssh-ldapcentos-upgrade-openssh-servercentos-upgrade-openssh-server-sysvinitcentos-upgrade-pam_ssh_agent_auth | Aug 2, 2023 | Jul 20, 2023 |
| Debian | debian-upgrade-openssh | Aug 18, 2023 | Jul 20, 2023 | |
| Dell Powerstore Dsa2024120 | dell-powerstoreos-upgrade-latest | Oct 23, 2025 | Mar 26, 2024 | |
| Freebsd | freebsd-upgrade-base-13_2-release-p2freebsd-upgrade-base-13_1-release-p9freebsd-upgrade-base-12_4-release-p4freebsd-upgrade-package-openssh-portablefreebsd-upgrade-package-openssh-portable-hpnfreebsd-upgrade-package-openssh-portable-gssapi | Aug 31, 2023 | Aug 31, 2023 | |
| Gentoo Linux | gentoo-linux-upgrade-net-misc-openssh | Jul 20, 2023 | Jul 20, 2023 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-opensshhuawei-euleros-2_0_sp10-upgrade-openssh-clientshuawei-euleros-2_0_sp10-upgrade-openssh-server | Jan 10, 2024 | Jul 20, 2023 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-opensshhuawei-euleros-2_0_sp11-upgrade-openssh-clientshuawei-euleros-2_0_sp11-upgrade-openssh-server | Jan 10, 2024 | Jul 20, 2023 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-opensshhuawei-euleros-2_0_sp8-upgrade-openssh-askpasshuawei-euleros-2_0_sp8-upgrade-openssh-cavshuawei-euleros-2_0_sp8-upgrade-openssh-clientshuawei-euleros-2_0_sp8-upgrade-openssh-keycathuawei-euleros-2_0_sp8-upgrade-openssh-ldaphuawei-euleros-2_0_sp8-upgrade-openssh-server | Jan 10, 2024 | Jul 20, 2023 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-opensshhuawei-euleros-2_0_sp9-upgrade-openssh-clientshuawei-euleros-2_0_sp9-upgrade-openssh-server | Jan 10, 2024 | Jul 20, 2023 | |
| Ibm Aix | ibm-aix-openssh_advisory15 | Aug 24, 2023 | Jul 20, 2023 | |
| Nutanix Ahv | nutanix-ahv-upgrade-latest | Jun 5, 2026 | Sep 22, 2023 | |
| Openbsd Openssh | openbsd-openssh-upgrade-9_3p2 | Aug 2, 2023 | Jul 20, 2023 | |
| Oracle_linux | — | oracle-linux-upgrade-opensshoracle-linux-upgrade-openssh-askpassoracle-linux-upgrade-openssh-cavsoracle-linux-upgrade-openssh-clientsoracle-linux-upgrade-openssh-keycatoracle-linux-upgrade-openssh-ldaporacle-linux-upgrade-openssh-serveroracle-linux-upgrade-openssh-server-sysvinitoracle-linux-upgrade-pam-ssh-agent-auth | Aug 3, 2023 | Jul 19, 2023 |
| Redhat_linux | redhat-upgrade-opensshredhat-upgrade-openssh-askpassredhat-upgrade-openssh-askpass-debuginforedhat-upgrade-openssh-cavsredhat-upgrade-openssh-cavs-debuginforedhat-upgrade-openssh-clientsredhat-upgrade-openssh-clients-debuginforedhat-upgrade-openssh-debuginforedhat-upgrade-openssh-debugsourceredhat-upgrade-openssh-keycatredhat-upgrade-openssh-keycat-debuginforedhat-upgrade-openssh-ldapredhat-upgrade-openssh-ldap-debuginforedhat-upgrade-openssh-serverredhat-upgrade-openssh-server-debuginforedhat-upgrade-openssh-server-sysvinitredhat-upgrade-openssh-sk-dummy-debuginforedhat-upgrade-pam_ssh_agent_authredhat-upgrade-pam_ssh_agent_auth-debuginfo | Aug 1, 2023 | Jul 20, 2023 | |
| Rocky_linux | rocky-upgrade-opensshrocky-upgrade-openssh-askpassrocky-upgrade-openssh-askpass-debuginforocky-upgrade-openssh-cavsrocky-upgrade-openssh-cavs-debuginforocky-upgrade-openssh-clientsrocky-upgrade-openssh-clients-debuginforocky-upgrade-openssh-debuginforocky-upgrade-openssh-debugsourcerocky-upgrade-openssh-keycatrocky-upgrade-openssh-keycat-debuginforocky-upgrade-openssh-ldaprocky-upgrade-openssh-ldap-debuginforocky-upgrade-openssh-serverrocky-upgrade-openssh-server-debuginforocky-upgrade-pam_ssh_agent_authrocky-upgrade-pam_ssh_agent_auth-debuginfo | Mar 5, 2024 | Jul 20, 2023 | |
| Suse | — | suse-upgrade-opensshsuse-upgrade-openssh-askpass-gnomesuse-upgrade-openssh-cavssuse-upgrade-openssh-clientssuse-upgrade-openssh-commonsuse-upgrade-openssh-fipssuse-upgrade-openssh-helperssuse-upgrade-openssh-server | Jul 24, 2023 | Jul 20, 2023 |
| Ubuntu | ubuntu-pro-upgrade-openssh-clientubuntu-upgrade-openssh-client | Jul 25, 2023 | Jul 20, 2023 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jul 20, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub