CVE-2023-38408 - Openssh vulnerability

[Neša]

A new vulnerability in OpenSSH versions that are below 9.32_p2, there is no back port to redhat/rocky/alma.
This redhat link has ways of mitigating the risk.
https://access.redhat.com/security/cve/CVE-2023-38408

[Bigguy]

Good post for those that need it.

[Skhilled]

Thanks, Nesa!

[Bigguy]

Changed the icon on the first post.

[Neša]

Changed the icon on the first post.

Thanks.

I should have posted earlier Red Hat and all the down stream (Rocky, Alma) have a back port patch please update your servers if you haven't already.

[Skhilled]

Ah! That may have been the Easyapache updates I saw about 2 days ago. I updated the server then. I no long run the server but still have access to it.

[Neša]

Ah! That may have been the Easyapache updates I saw about 2 days ago. I updated the server then. I no long run the server but still have access to it.

It should have been an opnessh update, you can check the changelog to see if you have the update.

Code Select Expand

rpm -q openssh --changelog | grep CVE-2023-38408if you have the installed update you should see text like this.
You cannot view this attachment.

If you don't get that text you'll need to upgrade openssh.

[Skhilled]

Yes, it's updated.