Credentials management in OpenSSH - CVE-2023-28531

Vulnerability identifier: #VU73775

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-28531

CWE-ID: CWE-255

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass implemented security restrictions.

the vulnerability exists due to a logic error in ssh-add when adding smartcard keys to ssh-agent with the per-hop destination constraints. As a result, the keys are added without constraints.

OpenSSH
Gentoo Linux
Debian Linux
FreeBSD
Slackware Linux
Ubuntu
Fedora
openssh-client (Ubuntu package)
openssh-server (Ubuntu package)
openssh (Debian package)
openssh
Storage Protect Plus Container Agent

Install updates from vendor's website.

OpenSSH - update to 9.3p1
openssh-client (Ubuntu package) - addressed in versions 1:8.2p1-4ubuntu0.10, 1:8.9p1-3ubuntu0.5, 1:9.0p1-1ubuntu8.6, 1:9.3p1-1ubuntu3.1
openssh-server (Ubuntu package) - addressed in versions 1:8.2p1-4ubuntu0.10, 1:8.9p1-3ubuntu0.5, 1:9.0p1-1ubuntu8.6, 1:9.3p1-1ubuntu3.1
openssh (Debian package) - addressed in versions 1:8.4p1-5+deb11u3, 1:9.2p1-2+deb12u2
openssh - update to 9.0p1-19.fc38
openssh - update to 9.3p1
Storage Protect Plus Container Agent - update to 10.1.12.6

• https://www.openwall.com/lists/oss-security/2023/03/15/8

• Multiple vulnerabilities in OpenSSH
• Slackware Linux update for openssh
• FreeBSD update for openssh
• Gentoo update for OpenSSH
• Multiple vulnerabilities in IBM Spectrum Protect Plus Container
• Ubuntu update for openssh
• Debian update for openssh
• Fedora 38 update for openssh