QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2023-38408

Back to search

CVE-2023-38408

Published: Jul 20, 2023

Modified: Oct 15, 2024

PUBLISHED

Description

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

VendorProductVersions

n/a

n/a

affected
n/a

References

GLSA-202307-01
vendor-advisory
FEDORA-2023-878e04f4ae
vendor-advisory
FEDORA-2023-79a18e1725
vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now