Wind River Support Network

HomeDefectsLIN1018-10302

Acknowledged

LIN1018-10302 : Security Advisory - openssh - CVE-2023-25136

Created: Feb 3, 2023 Updated: Apr 15, 2024

Resolved Date: Feb 4, 2023

Found In Version: 10.18.44.1

Severity: Standard

Applicable for: Wind River Linux LTS 18

Component/s: Userspace

Description

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be triggered by an unauthenticated attacker in the default configuration; however, the vulnerability discoverer reports that "exploiting this vulnerability will not be easy."

CREATE(Triage):(User=admin) CVE-2023-25136 (https://nvd.nist.gov/vuln/detail/CVE-2023-25136)