OpenSSH: Schwachstelle ermöglicht Codeausführung
WID-SEC-2023-1819 · first 20.07.2023 · updated 24.09.2026 · CVSS 9,8
What it is about
OpenSSH ist eine Open Source Implementierung des Secure Shell Protokolls. Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenSSH ausnutzen, um beliebigen Programmcode auszuführen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- beliebigen Programmcode auszuführen
Am I affected?
Affected according to the BSI:
- IBM VIOS 3.1
- IBM Security Guardium 11.3
- IBM Security Guardium 11.4
- Open Source CentOS
- Debian Linux
- Amazon Linux 2
- FreeBSD Project FreeBSD OS
- IBM AIX 7.2
- Red Hat Enterprise Linux
- Fedora Linux
- Ubuntu Linux
- SUSE Linux
and 20 more
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source OpenSSH 9.3p2
- IBM Spectrum Protect plus 10.1.15.3
- Dell NetWorker vProxy OVA 19.9.0.5
- Alcatel Lucent Enterprise OmniSwitch AOS 8.9.R04
- Dell Avamar 19.12
- IBM Security Verify Access 10.0.9.1
- IBM Security Verify Access 11.0.2
- Moxa Switch 4.1.58
- Moxa Switch 5.0.4
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- OpenSSH Security Notification vom 2023-07-19 seclists.org
- Fedora Security Advisory FEDORA-2023-79A18E1725 vom 2023-07-21 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2023-878E04F4AE vom 2023-07-21 bodhi.fedoraproject.org
- Ubuntu Security Notice USN-6242-1 vom 2023-07-24 ubuntu.com
- SUSE Security Update SUSE-SU-2023:2945-1 vom 2023-07-24 lists.suse.com
- SUSE Security Update SUSE-SU-2023:2940-1 vom 2023-07-24 lists.suse.com
- SUSE Security Update SUSE-SU-2023:2946-1 vom 2023-07-24 lists.suse.com
- SUSE Security Update SUSE-SU-2023:2947-1 vom 2023-07-24 lists.suse.com
- SUSE Security Update SUSE-SU-2023:2950-1 vom 2023-07-24 lists.suse.com
- IGEL Security Notice ISN-2023-14 vom 2023-07-26 kb.igel.com
- Red Hat Security Advisory RHSA-2023:4329 vom 2023-07-31 access.redhat.com
- Ubuntu Security Notice USN-6242-2 vom 2023-07-31 ubuntu.com
- Red Hat Security Advisory RHSA-2023:4413 vom 2023-08-01 access.redhat.com
- FreeBSD Security Advisory FREEBSD-SA-23:08.SSH vom 2023-08-01 www.freebsd.org
- Red Hat Security Advisory RHSA-2023:4384 vom 2023-08-01 access.redhat.com
- Red Hat Security Advisory RHSA-2023:4381 vom 2023-08-01 access.redhat.com
- Red Hat Security Advisory RHSA-2023:4382 vom 2023-08-01 access.redhat.com
- Red Hat Security Advisory RHSA-2023:4383 vom 2023-08-01 access.redhat.com
- Red Hat Security Advisory RHSA-2023:4419 vom 2023-08-01 access.redhat.com
- Red Hat Security Advisory RHSA-2023:4412 vom 2023-08-01 access.redhat.com
- Red Hat Security Advisory RHSA-2023:4428 vom 2023-08-02 access.redhat.com
- Oracle Linux Security Advisory ELSA-2023-4382 vom 2023-08-02 linux.oracle.com
- Oracle Linux Security Advisory ELSA-2023-4412 vom 2023-08-02 linux.oracle.com
- Oracle Linux Security Advisory ELSA-2023-4419 vom 2023-08-02 linux.oracle.com
- NetApp Security Advisory NTAP-20230803-0010 vom 2023-08-03 security.netapp.com
and 21 more sources in the original advisory
CVE: CVE-2023-38408
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.