RHSA-2024:4389HighCVSS 8.1

Red Hat Security Advisory: openssh security update

Published
July 8, 2024
Last Modified
November 6, 2026

🔗 CVE IDs covered (1)

CVE-2024-6387 →

📋 Description

CVE-2024-6387 — openssh: regreSSHion - race condition in SSH allows RCE/DoS

🎯 Affected products83

  • Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-0:8.7p1-12.el9_0.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-0:8.7p1-12.el9_0.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-0:8.7p1-12.el9_0.1.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-0:8.7p1-12.el9_0.1.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-0:8.7p1-12.el9_0.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-askpass-0:8.7p1-12.el9_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • openssh-askpass-0:8.7p1-12.el9_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • openssh-askpass-0:8.7p1-12.el9_0.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • openssh-askpass-0:8.7p1-12.el9_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • openssh-askpass-debuginfo-0:8.7p1-12.el9_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • openssh-askpass-debuginfo-0:8.7p1-12.el9_0.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-askpass-debuginfo-0:8.7p1-12.el9_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • openssh-askpass-debuginfo-0:8.7p1-12.el9_0.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-askpass-debuginfo-0:8.7p1-12.el9_0.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • openssh-askpass-debuginfo-0:8.7p1-12.el9_0.1.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-askpass-debuginfo-0:8.7p1-12.el9_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • openssh-askpass-debuginfo-0:8.7p1-12.el9_0.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-clients-0:8.7p1-12.el9_0.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-clients-0:8.7p1-12.el9_0.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-clients-0:8.7p1-12.el9_0.1.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-clients-0:8.7p1-12.el9_0.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-clients-debuginfo-0:8.7p1-12.el9_0.1.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • openssh-clients-debuginfo-0:8.7p1-12.el9_0.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-clients-debuginfo-0:8.7p1-12.el9_0.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • openssh-clients-debuginfo-0:8.7p1-12.el9_0.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-clients-debuginfo-0:8.7p1-12.el9_0.1.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • openssh-clients-debuginfo-0:8.7p1-12.el9_0.1.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • openssh-clients-debuginfo-0:8.7p1-12.el9_0.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • +53 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The below process can protect against a Remote Code Execution attack by disabling the LoginGraceTime parameter on Red Hat Enterprise Linux 9. However, the sshd server is still vulnerable to a Denial of Service if an attacker exhausts all the connections. 1) As root user, open the /etc/ssh/sshd_config 2) Add or edit the parameter configuration: ~~~ LoginGraceTime 0 ~~~ 3) Save and close the file 4) Restart the sshd daemon: ~~~ systemctl restart sshd.service ~~~ Setting LoginGraceTime to 0 disables the SSHD server's ability to drop connections if authentication is not completed within the specified timeout. If this mitigation is implemented, it is highly recommended to use a tool like 'fail2ban' alongside a firewall to monitor log files and manage connections appropriately. If any of the mitigations mentioned above is used, please note that the removal of LoginGraceTime parameter from sshd_config is not automatic when the updated package is installed.

🔗 References (4)