UBUNTU-CVE-2023-28531

Details

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

Affected Packages

Ubuntu:22.04:LTSopenssh

Affected versions:

1:8.4p1-6ubuntu21:8.7p1-21:8.7p1-2build11:8.7p1-41:8.8p1-11:8.9p1-31:8.9p1-3ubuntu0.11:8.9p1-3ubuntu0.31:8.9p1-3ubuntu0.4

Fixed in:

1:8.9p1-3ubuntu0.5

References

REPORThttps://ubuntu.com/security/CVE-2023-28531 REPORThttps://ubuntu.com/security/notices/USN-6560-1 REPORThttps://www.cve.org/CVERecord?id=CVE-2023-28531 REPORThttps://www.openwall.com/lists/oss-security/2023/03/15/8

UBUNTU-CVE-2023-28531

Details

Affected Packages

References

CVSS Analysis

Related

Ecosystems

Timeline