Medium severity · published Feb 3, 2023
CVE-2023-25136
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling
6.5
CVSS
89.8%
EPSS
No
On KEV
Description
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)89.8% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
5F
500f Firmware · Netapp
All versions, or not specified · source: NVD
AF
A250 Firmware · Netapp
All versions, or not specified · source: NVD
CF
C250 Firmware · Netapp
All versions, or not specified · source: NVD
FE
Fedora · Fedoraproject
37; 38 · source: NVD
OS
Ontap Select Deploy Administration Utility · Netapp
All versions, or not specified · source: NVD
OP
Openssh · Openbsd
9.1 · source: NVD
SS
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SS
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SS
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-25136
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-25136
Mailing List
http://www.openwall.com/lists/oss-security/2023/02/13/1
Mailing List
http://www.openwall.com/lists/oss-security/2023/02/22/1
Mailing List
http://www.openwall.com/lists/oss-security/2023/02/22/2
Mailing List
http://www.openwall.com/lists/oss-security/2023/02/23/3
Mailing List
http://www.openwall.com/lists/oss-security/2023/03/06/1
Mailing List
http://www.openwall.com/lists/oss-security/2023/03/09/2
More from Fedora
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)