An update of the openssh package has been released.

  - sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows     privilege escalation because supplemental groups are not initialized as expected. Helper programs for     AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group     memberships of the sshd process, if the configuration specifies running the command as a different user.
    (CVE-2021-41617)

  - OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username     and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a     challenge is sent only when that combination could be valid for a login session. (CVE-2016-20012)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

バナーによると、リモートホストで実行されている OpenSSH のバージョンは、複数の脆弱性の影響を受ける可能性があります。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

根據其標題，遠端主機上執行的 OpenSSH 版本受多個弱點影響。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

根据其标题，远程主机上运行的 OpenSSH 版本受到多个漏洞影响。

请注意，Nessus 尚未测试这些问题，而是只依靠应用程序自我报告的版本号来判断。

According to its banner, the version of OpenSSH running on the remote host is potentially affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssh: Public key information leak (CVE-2016-20012)

  - openssh: authentication bypass via row hammer attack (CVE-2023-51767)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssh: User enumeration via malformed packets in authentication requests (CVE-2018-15919)

  - openssh: authentication bypass via row hammer attack (CVE-2023-51767)

  - OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username     and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a     challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not     recognize user enumeration as a vulnerability for this product (CVE-2016-20012)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	名稱	產品	系列	已發布	已更新	嚴重性
153972	Photon OS 4.0: Openssh PHSA-2021-4.0-0113	Nessus	PhotonOS Local Security Checks	2021/10/10	2023/11/28	high
159492	OpenSSH PCI の異論のある脆弱性。	Nessus	Misc.	2022/4/4	2024/3/27	high
159492	OpenSSH PCI 爭議性弱點。	Nessus	Misc.	2022/4/4	2024/3/27	high
159492	OpenSSH PCI 争议性漏洞。	Nessus	Misc.	2022/4/4	2024/3/27	high
159492	OpenSSH PCI Disputed Vulnerabilities.	Nessus	Misc.	2022/4/4	2024/3/27	high
198870	RHEL 9 : openssh (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high
198948	RHEL 8 : openssh (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high