CVE-2023-51384
Publication date 20 December 2023
Last updated 11 February 2025
Ubuntu priority
Cvss 3 Severity Score
In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.
Status
Package | Ubuntu Release | Status |
---|---|---|
openssh | 24.10 oracular |
Fixed 1:9.6p1-3ubuntu1
|
24.04 LTS noble |
Fixed 1:9.6p1-3ubuntu1
|
|
22.04 LTS jammy |
Fixed 1:8.9p1-3ubuntu0.6
|
|
20.04 LTS focal FIPS |
Not affected
|
|
18.04 LTS bionic |
Not affected
|
|
16.04 LTS xenial |
Not affected
|
|
14.04 LTS trusty |
Not affected
|
|
openssh-ssh1 | 24.10 oracular | Ignored |
24.04 LTS noble | Ignored | |
22.04 LTS jammy | Ignored | |
20.04 LTS focal | Ignored | |
18.04 LTS bionic | Ignored | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release |
Notes
mdeslaur
openssh-ssh1 is only provided for compatibility with old devices that cannot be upgraded to modern protocols. We will not be providing any security support for the openssh-ssh1 package as it is insecure and should be used in trusted environments only. destination constraints were added in 8.9
Severity score breakdown
Parameter | Value |
---|---|
Base score |
|
Attack vector | Local |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | None |
Availability impact | None |
Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-6565-1
- OpenSSH vulnerabilities
- 3 January 2024