CVE-2023-28531

Critical

Description

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

SeverityCritical

CVSS9.8

Exploit probability—

ProductOpenbsd Openssh

PublishedMar 17, 2023

First seenMar 17, 2023

Weakness typeCWE-284Improper access control

How to fix

Update

openbsd openssh9.3 or later

Vendor advisories

security.gentoo.org/glsa/202307-01
debian.org/security/2023/dsa-5586
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AN2UDTXEUSKFIOIYMV6JNI5VSBMYZOFT/

Affected products

Product	Affected versions	Fixed in
openbsd openssh	8.9 ≤ v < 9.3	9.3
netapp brocade_fabric_operating_system	No range specified	—
netapp hci_bootstrap_os	No range specified	—
netapp solidfire_element_os	No range specified	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.