PT-2023-7885 · Openssh+7 · Openssh+7

Fabian Bäumer + 2 · Published 2023-12-18 · Updated 2026-05-12 · CVE-2023-51384

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 9.6

Description The issue is related to errors in key management in the ssh-agent tool of OpenSSH. It allows an attacker to disclose protected information by exploiting certain destination constraints that are not fully applied when adding PKCS#11-hosted private keys. Specifically, when destination constraints are specified, they are only applied to the first key, even if a PKCS#11 token returns multiple keys. This can be exploited by sending a specially crafted request to obtain sensitive information, which can then be used to launch further attacks against the affected system.

Recommendations For OpenSSH versions prior to 9.6, update to OpenSSH 9.6 to resolve the issue. As a temporary workaround, consider restricting the use of PKCS#11-hosted private keys until a patch is available. Avoid using the PKCS#11 token in the affected ssh-agent tool to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-320

CWE-284

Related Identifiers

ALT-PU-2024-1046

ALT-PU-2024-1364

ALT-PU-2024-17672

ALT-PU-2024-3921

ALT-PU-2024-4077

ALT-PU-2024-4467

ALT-PU-2024-9513

AZL-32205

AZL-35081

BDU:2023-08956

CVE-2023-51384

DSA-5586-1

MGASA-2024-0010

ROSA-SA-2025-2662

USN-6565-1

Affected Products

Alt Linux

Astra Linux

Ibm Aix

Linuxmint

Apple Macos

Openssh

Red Os

Ubuntu

References · 60

• https://github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b · Patch
• https://osv.dev/vulnerability/CVE-2023-51384 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-51384 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6565-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-51384 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5586-1 · Vendor Advisory
• https://debian.org/security/2023/dsa-5586 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35081 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-ALPINE-318-CVE-2023-51384 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-51384 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-51385 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2023-51384 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6565-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-51384 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0010.html · Security Note