Red Hat, Inc. https://access.redhat.com/errata/RHSA-2024:4340 [No types assigned]

https://sig-security.rocky.page/issues/CVE-2024-6387/ No Types Assigned

https://sig-security.rocky.page/issues/CVE-2024-6387/ Third Party Advisory

Red Hat, Inc. https://sig-security.rocky.page/issues/CVE-2024-6387/ [No types assigned]

OR
     *cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* versions from (including) 11.0.0 up to (including) 11.70.2
     *cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
     *cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*

OR
     *cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* versions up to (excluding) 4.4
     *cpe:2.3:a:openbsd:openssh:4.4:-:*:*:*:*:*:*
     *cpe:2.3:a:openbsd:openssh:8.5:p1:*:*:*:*:*:*
     *cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* versions from (including) 8.6 up to (excluding) 9.8
     *cpe:2.3:a:openbsd:openssh:9.8:-:*:*:*:*:*:*

OR
     *cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s

OR
     *cpe:2.3:o:amazon:linux_2023:-:*:*:*:*:*:*:*

OR
     *cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*
     *cpe:2.3:o:canonical:ubuntu_linux:22.10:*:*:*:-:*:*:*
     *cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:lts:*:*:*

OR
     *cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

OR
     *cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:*
     *cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:*
     *cpe:2.3:o:freebsd:freebsd:13.2:p10:*:*:*:*:*:*
     *cpe:2.3:o:freebsd:freebsd:13.2:p11:*:*:*:*:*:*
     *cpe:2.3:o:freebsd:freebsd:13.2:p2:*:*:*:*:*:*
     *cpe:2.3:o:freebsd:freebsd:13.2:p3:*:*:*:*:*:*
     *cpe:2.3:o:freebsd:freebsd:13.2:p4:*:*:*:*:*:*
     *cpe:2.3:o:freebsd:freebsd:13.2:p5:*:*:*:*:*:*
     *cpe:2.3:o:freebsd:freebsd:13.2:p6:*:*:*:*:*:*
     *cpe:2.3:o:freebsd:free

OR
     *cpe:2.3:o:netbsd:netbsd:*:*:*:*:*:*:*:* versions up to (including) 10.0.0

OR
     *cpe:2.3:o:suse:linux_enterprise_micro:6.0:*:*:*:*:*:*:*

NIST AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NIST CWE-362

http://www.openwall.com/lists/oss-security/2024/07/01/12 No Types Assigned

http://www.openwall.com/lists/oss-security/2024/07/01/12 Mailing List

http://www.openwall.com/lists/oss-security/2024/07/01/13 No Types Assigned

http://www.openwall.com/lists/oss-security/2024/07/01/13 Mailing List

http://www.openwall.com/lists/oss-security/2024/07/02/1 No Types Assigned

http://www.openwall.com/lists/oss-security/2024/07/02/1 Mailing List

http://www.openwall.com/lists/oss-security/2024/07/03/1 No Types Assigned

http://www.openwall.com/lists/oss-security/2024/07/03/1 Mailing List

http://www.openwall.com/lists/oss-security/2024/07/03/11 No Types Assigned

http://www.openwall.com/lists/oss-security/2024/07/03/11 Mailing List

http://www.openwall.com/lists/oss-security/2024/07/03/2 No Types Assigned

http://www.openwall.com/lists/oss-security/2024/07/03/2 Mailing List

http://www.openwall.com/lists/oss-security/2024/07/03/3 No Types Assigned

http://www.openwall.com/lists/oss-security/2024/07/03/3 Mailing List

http://www.openwall.com/lists/oss-security/2024/07/03/4 No Types Assigned

http://www.openwall.com/lists/oss-security/2024/07/03/4 Mailing List

http://www.openwall.com/lists/oss-security/2024/07/03/5 No Types Assigned

http://www.openwall.com/lists/oss-security/2024/07/03/5 Mailing List

http://www.openwall.com/lists/oss-security/2024/07/04/1 No Types Assigned

http://www.openwall.com/lists/oss-security/2024/07/04/1 Mailing List

http://www.openwall.com/lists/oss-security/2024/07/04/2 No Types Assigned

http://www.openwall.com/lists/oss-security/2024/07/04/2 Mailing List

https://access.redhat.com/errata/RHSA-2024:4312 No Types Assigned

https://access.redhat.com/errata/RHSA-2024:4312 Third Party Advisory

https://access.redhat.com/security/cve/CVE-2024-6387 No Types Assigned

https://access.redhat.com/security/cve/CVE-2024-6387 Third Party Advisory

https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/ No Types Assigned

https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/ Third Party Advisory

https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/ No Types Assigned

https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/ Press/Media Coverage, Third Party Advisory

https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server No Types Assigned

https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server Exploit, Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2294604 No Types Assigned

https://bugzilla.redhat.com/show_bug.cgi?id=2294604 Issue Tracking

https://explore.alas.aws.amazon.com/CVE-2024-6387.html No Types Assigned

https://explore.alas.aws.amazon.com/CVE-2024-6387.html Third Party Advisory

https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc No Types Assigned

https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc Third Party Advisory

https://github.com/AlmaLinux/updates/issues/629 No Types Assigned

https://github.com/AlmaLinux/updates/issues/629 Issue Tracking

https://github.com/Azure/AKS/issues/4379 No Types Assigned

https://github.com/Azure/AKS/issues/4379 Issue Tracking

https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 No Types Assigned

https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 Issue Tracking

https://github.com/PowerShell/Win32-OpenSSH/issues/2249 No Types Assigned

https://github.com/PowerShell/Win32-OpenSSH/issues/2249 Issue Tracking

https://github.com/microsoft/azurelinux/issues/9555 No Types Assigned

https://github.com/microsoft/azurelinux/issues/9555 Issue Tracking

https://github.com/oracle/oracle-linux/issues/149 No Types Assigned

https://github.com/oracle/oracle-linux/issues/149 Issue Tracking

https://github.com/rapier1/hpn-ssh/issues/87 No Types Assigned

https://github.com/rapier1/hpn-ssh/issues/87 Issue Tracking

https://github.com/zgzhang/cve-2024-6387-poc No Types Assigned

https://github.com/zgzhang/cve-2024-6387-poc Third Party Advisory

https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html No Types Assigned

https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html Mailing List, Third Party Advisory

https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html No Types Assigned

https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html Mailing List, Patch

https://news.ycombinator.com/item?id=40843778 No Types Assigned

https://news.ycombinator.com/item?id=40843778 Issue Tracking, Patch

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010 No Types Assigned

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010 Third Party Advisory

https://security-tracker.debian.org/tracker/CVE-2024-6387 No Types Assigned

https://security-tracker.debian.org/tracker/CVE-2024-6387 Third Party Advisory

https://security.netapp.com/advisory/ntap-20240701-0001/ No Types Assigned

https://security.netapp.com/advisory/ntap-20240701-0001/ Third Party Advisory

https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/ No Types Assigned

https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/ Third Party Advisory

https://ubuntu.com/security/CVE-2024-6387 No Types Assigned

https://ubuntu.com/security/CVE-2024-6387 Third Party Advisory

https://ubuntu.com/security/notices/USN-6859-1 No Types Assigned

https://ubuntu.com/security/notices/USN-6859-1 Third Party Advisory

https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc No Types Assigned

https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc Third Party Advisory

https://www.openssh.com/txt/release-9.8 No Types Assigned

https://www.openssh.com/txt/release-9.8 Release Notes

https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt No Types Assigned

https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt Exploit, Third Party Advisory

https://www.suse.com/security/cve/CVE-2024-6387.html No Types Assigned

https://www.suse.com/security/cve/CVE-2024-6387.html Third Party Advisory

https://www.theregister.com/2024/07/01/regresshion_openssh/ No Types Assigned

https://www.theregister.com/2024/07/01/regresshion_openssh/ Third Party Advisory

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/04/2 [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/04/1 [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/11 [No types assigned]

Red Hat, Inc. https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/ [No types assigned]

Red Hat, Inc. https://github.com/AlmaLinux/updates/issues/629 [No types assigned]

Red Hat, Inc. https://github.com/Azure/AKS/issues/4379 [No types assigned]

Red Hat, Inc. https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 [No types assigned]

Red Hat, Inc. https://github.com/PowerShell/Win32-OpenSSH/issues/2249 [No types assigned]

Red Hat, Inc. https://github.com/microsoft/azurelinux/issues/9555 [No types assigned]

Red Hat, Inc. https://access.redhat.com/errata/RHSA-2024:4312 [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/5 [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/4 [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/3 [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/1 [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/03/2 [No types assigned]

A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Red Hat, Inc. https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc [No types assigned]

Red Hat, Inc. https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/02/1 [No types assigned]

Red Hat, Inc. https://security.netapp.com/advisory/ntap-20240701-0001/ [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/01/13 [No types assigned]

Red Hat, Inc. https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010 [No types assigned]

Red Hat, Inc. https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/ [No types assigned]

Red Hat, Inc. https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/ [No types assigned]

Red Hat, Inc. https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server [No types assigned]

Red Hat, Inc. https://explore.alas.aws.amazon.com/CVE-2024-6387.html [No types assigned]

Red Hat, Inc. https://github.com/oracle/oracle-linux/issues/149 [No types assigned]

Red Hat, Inc. https://github.com/rapier1/hpn-ssh/issues/87 [No types assigned]

Red Hat, Inc. https://github.com/zgzhang/cve-2024-6387-poc [No types assigned]

Red Hat, Inc. https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html [No types assigned]

Red Hat, Inc. https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html [No types assigned]

Red Hat, Inc. https://news.ycombinator.com/item?id=40843778 [No types assigned]

Red Hat, Inc. https://security-tracker.debian.org/tracker/CVE-2024-6387 [No types assigned]

Red Hat, Inc. https://ubuntu.com/security/CVE-2024-6387 [No types assigned]

Red Hat, Inc. https://ubuntu.com/security/notices/USN-6859-1 [No types assigned]

Red Hat, Inc. https://www.openssh.com/txt/release-9.8 [No types assigned]

Red Hat, Inc. https://www.suse.com/security/cve/CVE-2024-6387.html [No types assigned]

Red Hat, Inc. https://www.theregister.com/2024/07/01/regresshion_openssh/ [No types assigned]

Red Hat, Inc. http://www.openwall.com/lists/oss-security/2024/07/01/12 [No types assigned]

Red Hat, Inc. AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat, Inc. CWE-364

A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().

Red Hat, Inc. https://access.redhat.com/security/cve/CVE-2024-6387 [No types assigned]

Red Hat, Inc. https://bugzilla.redhat.com/show_bug.cgi?id=2294604 [No types assigned]

Red Hat, Inc. https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt [No types assigned]