Description
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
Problem types
Product status
8.5p1 (custom)
0:8.7p1-38.el9_4.1 (rpm) before *
0:8.7p1-38.el9_4.1 (rpm) before *
0:8.7p1-12.el9_0.1 (rpm) before *
0:8.7p1-30.el9_2.4 (rpm) before *
413.92.202407091321-0 (rpm) before *
414.92.202407091253-0 (rpm) before *
415.92.202407091355-0 (rpm) before *
416.94.202407081958-0 (rpm) before *
Timeline
| 2024-06-27: | Reported to Red Hat. |
| 2024-07-01: | Made public. |
Credits
Red Hat would like to thank Qualys Threat Research Unit (TRU) (Qualys) for reporting this issue.
References
access.redhat.com/errata/RHSA-2024:4312 (RHSA-2024:4312)
access.redhat.com/errata/RHSA-2024:4340 (RHSA-2024:4340)
access.redhat.com/errata/RHSA-2024:4389 (RHSA-2024:4389)
access.redhat.com/errata/RHSA-2024:4469 (RHSA-2024:4469)
access.redhat.com/errata/RHSA-2024:4474 (RHSA-2024:4474)
access.redhat.com/errata/RHSA-2024:4479 (RHSA-2024:4479)
access.redhat.com/errata/RHSA-2024:4484 (RHSA-2024:4484)
access.redhat.com/security/cve/CVE-2024-6387
bugzilla.redhat.com/show_bug.cgi?id=2294604 (RHBZ#2294604)
santandersecurityresearch.github.io/...shing_the_masses.html
www.openssh.com/txt/release-9.8
www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
