PT-2023-3666 · Openssh+13 · Openssh+13

Baba Yaga · CVE-2023-38408 · Published 2023-07-19 · Updated 2026-05-13

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSSH versions 7.9p1-alt4.gost.p10.1, 7.9p1-alt4.p10.6, 9.6p1-alt1.gost, 9.6p1-alt2.gost

Description OpenSSH contains a vulnerability where the ssh-agent component incorrectly handles loading certain PKCS#11 providers. This can allow a remote attacker to execute arbitrary code if a user has forwarded their ssh-agent to an untrusted system and that system contains malicious libraries. The vulnerability exists due to improper handling of library loading, potentially leading to the execution of untrusted code.

Recommendations Update OpenSSH to version 7.9p1-alt4.gost.p10.1, 7.9p1-alt4.p10.6, 9.6p1-alt1.gost, or 9.6p1-alt2.gost.

Exploit

Fix

LPE

RCE

Code Injection

Untrusted Search Path

Weakness Enumeration

CWE-428

CWE-94

CWE-426

Related Identifiers

ALSA-2023:4412

ALSA-2023:4419

ALSA-2023_4412

ALSA-2023_4419

ALSA-2024_1130

ALSA-2024_1150

ALSA-2025_16880

ALT-PU-2023-4471

ALT-PU-2023-4472

ALT-PU-2023-4480

ALT-PU-2023-4654

ALT-PU-2024-12010

ALT-PU-2024-12012

ALT-PU-2024-17672

ALT-PU-2024-3921

ALT-PU-2024-4077

ALT-PU-2024-4467

ALT-PU-2024-7269

ALT-PU-2024-9513

AZL-27651

BDU:2023-03950

CESA-2023_4382

CESA-2023_4419

CVE-2023-38408

DLA-3532-1

ELSA-2023-4382

ELSA-2023-4412

ELSA-2023-4419

ELSA-2023-4428

FREEBSD-SA-23_08

JLSEC-2026-68

MGASA-2024-0010

OESA-2023-1480

OPENSUSE-SU-2023_2945-1

OPENSUSE-SU-2024:13063-1

RHSA-2023:4329

RHSA-2023:4381

RHSA-2023:4382

RHSA-2023:4383

RHSA-2023:4384

RHSA-2023:4412

RHSA-2023:4413

RHSA-2023:4419

RHSA-2023:4428

RHSA-2023_4382

RHSA-2023_4412

RHSA-2023_4419

RLSA-2023:4419

RLSA-2023_4419

ROSA-SA-2023-2229

SUSE-SU-2023:2940-1

SUSE-SU-2023:2945-1

SUSE-SU-2023:2946-1

SUSE-SU-2023:2947-1

SUSE-SU-2023:2950-1

SUSE-SU-2023_2940-1

SUSE-SU-2023_2945-1

SUSE-SU-2023_2946-1

SUSE-SU-2023_2947-1

SUSE-SU-2023_2950-1

USN-6242-1

USN-6242-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Freebsd

Ibm Aix

Linuxmint

Apple Macos

Openssh

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 163

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38408.json · Exploit
• 🔥 https://github.com/kali-mx/CVE-2023-38408 · Exploit
• 🔥 https://github.com/LucasPDiniz/CVE-2023-38408 · Exploit
• 🔥 https://github.com/snowcra5h/CVE-2023-38408 · Exploit
• 🔥 https://qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html · Exploit
• 🔥 http://openwall.com/lists/oss-security/2023/07/20/1 · Exploit
• https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d · Patch
• https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8 · Patch
• https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca · Patch
• https://osv.dev/vulnerability/OESA-2023-1480 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-27651 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2950-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-4382.html · Vendor Advisory