UBUNTU-CVE-2023-28531

Details

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

Affected Packages

openssh

Ubuntu 22.04 LTS

Affected versions:

1:8.4p1-6ubuntu21:8.7p1-21:8.7p1-2build11:8.7p1-41:8.8p1-11:8.9p1-31:8.9p1-3ubuntu0.11:8.9p1-3ubuntu0.31:8.9p1-3ubuntu0.4

Fixed in:

1:8.9p1-3ubuntu0.5

References

REPORT

https://ubuntu.com/security/CVE-2023-28531

REPORT

https://ubuntu.com/security/notices/USN-6560-1

REPORT

https://www.cve.org/CVERecord?id=CVE-2023-28531

REPORT

https://www.openwall.com/lists/oss-security/2023/03/15/8