ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

An update of the openssh package has been released.

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0951 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-38408:
    The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path,     leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in     /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an     incomplete fix for CVE-2016-10009.

    CVE-2023-28531:
    ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination     constraints. The earliest affected version is 8.9.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of openssh installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-28531 advisory.

  - ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination     constraints. The earliest affected version is 8.9. (CVE-2023-28531)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-2aac54ebb7 advisory.

    Apply fix for CVE-2023-28531

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5586 advisory.

    Several vulnerabilities have been discovered in OpenSSH, an implementation of the SSH protocol suite.
    CVE-2021-41617 It was discovered that sshd failed to correctly initialise supplemental groups when     executing an AuthorizedKeysCommand or AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or     AuthorizedPrincipalsCommandUser directive has been set to run the command as a different user. Instead     these commands would inherit the groups that sshd was started with. CVE-2023-28531 Luci Stanescu reported     that a error prevented constraints being communicated to the ssh-agent when adding smartcard keys to the     agent with per-hop destination constraints, resulting in keys being added without constraints.
    CVE-2023-48795 Fabian Baeumer, Marcus Brinkmann and Joerg Schwenk discovered that the SSH protocol is     prone to a prefix truncation attack, known as the Terrapin attack. This attack allows a MITM attacker to     effect a limited break of the integrity of the early encrypted SSH transport protocol by sending extra     messages prior to the commencement of encryption, and deleting an equal number of consecutive messages     immediately after encryption starts. Details can be found at https://terrapin-attack.com/ CVE-2023-51384     It was discovered that when PKCS#11-hosted private keys were added while specifying destination     constraints, if the PKCS#11 token returned multiple keys then only the first key had the constraints     applied. CVE-2023-51385 It was discovered that if an invalid user or hostname that contained shell     metacharacters was passed to ssh, and a ProxyCommand, LocalCommand directive or match exec predicate     referenced the user or hostname via expansion tokens, then an attacker who could supply arbitrary     user/hostnames to ssh could potentially perform command injection. The situation could arise in case of     git repositories with submodules, where the repository could contain a submodule with shell characters in     its user or hostname. For the oldstable distribution (bullseye), these problems have been fixed in version     1:8.4p1-5+deb11u3. For the stable distribution (bookworm), these problems have been fixed in version     1:9.2p1-2+deb12u2. We recommend that you upgrade your openssh packages. For the detailed security status     of openssh please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/openssh

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6560-1 advisory.

    Fabian Bumer, Marcus Brinkmann, Jrg Schwenk discovered that the SSH protocol was vulnerable to a     prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension     negotiation messages could be truncated, possibly leading to certain algorithms and features being     downgraded. This issue is known as the Terrapin attack. This update adds protocol extensions to mitigate     this issue. (CVE-2023-48795)

    Luci Stanescu discovered that OpenSSH incorrectly added destination constraints when smartcard keys were     added to ssh-agent, contrary to expectations. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 23.04.
    (CVE-2023-28531)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination
    constraints. The earliest affected version is 8.9. (CVE-2023-28531)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e31a8f8e-47bf-11ee-8e38-002590c1f29c advisory.

  - ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination     constraints. The earliest affected version is 8.9. (CVE-2023-28531)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202307-01 (OpenSSH: Remote Code Execution)

  - OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling.
    This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in     the default configuration, to jump to any location in the sshd address space. One third-party report     states remote code execution is theoretically possible. (CVE-2023-25136)

  - ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination     constraints. The earliest affected version is 8.9. (CVE-2023-28531)

  -  Please review the CVE identifiers referenced below for details.  (CVE-2023-38408)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSH installed on the remote host is prior to 9.3. It is, therefore, affected by multiple vulnerabilities as referenced in the release-9.3 advisory.

  - ssh-add(1): when adding smartcard keys to ssh-agent(1) with the per-hop destination constraints (ssh-add
    -h ...) added in OpenSSH 8.9, a logic error prevented the constraints from being communicated to the     agent. This resulted in the keys being added without constraints. The common cases of non-smartcard keys     and keys without destination constraints are unaffected. (CVE-2023-28531) 

  - ssh(1): Portable OpenSSH provides an implementation of the getrrsetbyname(3) function if the standard     library does not provide it, for use by the VerifyHostKeyDNS feature. A specifically crafted DNS response     could cause this function to perform an out-of-bounds read of adjacent stack data, but this condition does     not appear to be exploitable beyond denial-of- service to the ssh(1) client. The getrrsetbyname(3)     replacement is only included if the system's standard library lacks this function and portable OpenSSH was     not compiled with the ldns library (--with-ldns). getrrsetbyname(3) is only invoked if using     VerifyHostKeyDNS to fetch SSHFP records.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
332652	Photon OS 5.0: Openssh PHSA-2023-5.0-91-0018	Nessus	PhotonOS Local Security Checks	Local	critical
503952	Siemens SIMATIC S7-1500 Missing Encryption of Sensitive Data (CVE-2023-28531)	Tenable OT Security	Tenable.ot	Remote	critical
239984	TencentOS Server 4: openssh (TSSA-2024:0951)	Nessus	Tencent Local Security Checks	Local	critical
203665	Photon OS 4.0: Openssh PHSA-2023-4.0-0444	Nessus	PhotonOS Local Security Checks	Local	critical
203510	Photon OS 5.0: Openssh PHSA-2023-5.0-0018	Nessus	PhotonOS Local Security Checks	Local	critical
201661	CBL Mariner 2.0 Security Update: openssh (CVE-2023-28531)	Nessus	MarinerOS Local Security Checks	Local	critical
190393	Fedora 38 : openssh (2024-2aac54ebb7)	Nessus	Fedora Local Security Checks	Local	critical
187213	Debian DSA-5586-1 : openssh - security update	Nessus	Debian Local Security Checks	Local	critical
187105	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : OpenSSH vulnerabilities (USN-6560-1)	Nessus	Ubuntu Local Security Checks	Local	medium
406072	Alpine: openssh: security update to 9.1_p1-r3	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
406072	Alpine: openssh: security update to 9.1_p1-r3	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
406070	Alpine: openssh: security update to 9.0_p1-r3	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
406070	Alpine: openssh: security update to 9.0_p1-r3	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
180340	FreeBSD : FreeBSD -- ssh-add does not honor per-hop destination constraints (e31a8f8e-47bf-11ee-8e38-002590c1f29c)	Nessus	FreeBSD Local Security Checks	Local	critical
178586	GLSA-202307-01 : OpenSSH: Remote Code Execution	Nessus	Gentoo Local Security Checks	Local	critical
173384	OpenSSH < 9.3 Multiple Vulnerabilities	Nessus	Misc.	Remote	critical

Detections

Analytics

CVE-2023-28531

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical

critical

critical

critical

critical

critical