ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade openssh | Jun 17, 2022 | Mar 5, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Mar 5, 2021 |
| Debian | — | Upgrade openssh | Jul 30, 2024 | Mar 5, 2021 |
| Freebsd | — | Upgrade openssh-portable-hpnUpgrade openssh-portable-gssapiUpgrade openssh-portable | Mar 19, 2021 | Mar 13, 2021 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | May 28, 2021 | Mar 5, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade opensshUpgrade openssh-clientsUpgrade openssh-server | Jun 2, 2021 | Mar 5, 2021 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 8.5 | Mar 11, 2021 | Mar 5, 2021 |
| Oracle Solaris | — | Upgrade network/ssh to version 8.4.0.1-11.4.33.0.1.94.0 on Solaris 11.4 | May 19, 2021 | Mar 5, 2021 |
| Suse | — | Upgrade openssh-cavsUpgrade openssh-serverUpgrade openssh-askpass-gnomeUpgrade openssh-fipsUpgrade openssh-commonUpgrade openssh-clientsUpgrade openssh-helpersUpgrade openssh | Dec 23, 2021 | Mar 5, 2021 |
| Ubuntu | — | Upgrade openssh-client | Mar 11, 2021 | Mar 5, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 5, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub