Skip to content
Fencer Vulns
critical 9.8

CVE-2023-38408 in the critical feed json

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if…

published 2023-07-20 3 y ago modified 2026-10-15 25 d ago also EUVD-2023-42225 , JLSEC-2026-68

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
79.7%
EPSS 79.7% chance of exploitation in 30 days, percentile 99.6%
public exploits
0
none known

Summary

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

Patch / fix

  • julia OpenSSH_jll 9.3.2+0
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • openssh Debian 12 1:9.2p1-2+deb12u1
  • openssh Debian 14, Debian 13 1:9.3p2-1

debian advisories DEBIAN-CVE-2023-38408

  • openssh Ubuntu 20.04 LTS 1:8.2p1-4ubuntu0.8
  • openssh Ubuntu 22.04 LTS 1:8.9p1-3ubuntu0.3
  • openssh Ubuntu Pro 14.04 LTS 1:6.6p1-2ubuntu2.13+esm1
  • openssh Ubuntu Pro 16.04 LTS 1:7.2p2-4ubuntu2.10+esm3
  • openssh Ubuntu Pro FIPS-updates 16.04 LTS 1:7.2p2-4ubuntu2.fips.2.10.4
  • openssh Ubuntu Pro 18.04 LTS 1:7.6p1-4ubuntu0.7+esm1
  • openssh Ubuntu Pro FIPS-updates 18.04 LTS 1:7.9p1-10~ubuntu18.04.fips.0.8
  • openssh Ubuntu Pro FIPS-updates 20.04 LTS 1:8.2p1-4ubuntu0.fips.0.8

ubuntu advisories UBUNTU-CVE-2023-38408

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssh RHEL 8 8.0p1-19.el8_8
  • openssh-cavs RHEL 8 8.0p1-19.el8_8
  • openssh-ldap RHEL 8 8.0p1-19.el8_8
  • openssh-keycat RHEL 8 8.0p1-19.el8_8
  • openssh-server RHEL 8 8.0p1-19.el8_8
  • openssh-askpass RHEL 8 8.0p1-19.el8_8
  • openssh-clients RHEL 8 8.0p1-19.el8_8
  • pam_ssh_agent_auth RHEL 8 0.10.3-7.19.el8_8

red hat advisories RHSA-2023:4428RHSA-2023:4413RHSA-2023:4419RHSA-2023:4383RHSA-2023:4384RHSA-2023:4382

  • openssh SLES for SAP 12 SP5, SLES 12 SP5 7.2p2-81.4.2
  • openssh-askpass-gnome SLES for SAP 12 SP5, SLES 12 SP5 7.2p2-81.4.2
  • openssh SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS +1 more 8.1p1-150200.5.37.1
  • openssh-askpass-gnome SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS +1 more 8.1p1-150200.5.37.1
  • openssh SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +14 more 8.4p1-150300.3.22.1
  • openssh-askpass-gnome SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +7 more 8.4p1-150300.3.22.1
  • openssh SLES 12 SP2-BCL 7.2p2-74.63.1
  • openssh-askpass-gnome SLES 12 SP2-BCL 7.2p2-74.63.1

suse advisories SUSE-SU-2023:2950-1SUSE-SU-2023:2947-1SUSE-SU-2023:2946-1SUSE-SU-2023:2945-1SUSE-SU-2023:2940-1

  • openssh openSUSE Tumbleweed 9.3p2-1.1

opensuse advisories openSUSE-SU-2024:13063-1

  • openssh AlmaLinux 8 8.0p1-33.el8_10
  • openssh-cavs AlmaLinux 8 8.0p1-33.el8_10
  • openssh-ldap AlmaLinux 8 8.0p1-33.el8_10
  • openssh-keycat AlmaLinux 8 8.0p1-33.el8_10
  • openssh-server AlmaLinux 8 8.0p1-33.el8_10
  • openssh-askpass AlmaLinux 8 8.0p1-33.el8_10
  • openssh-clients AlmaLinux 8 8.0p1-33.el8_10
  • pam_ssh_agent_auth AlmaLinux 8 0.10.3-8.33.el8_10

almalinux advisories ALSA-2026:69266ALSA-2023:4412ALSA-2023:4419

  • openssh Rocky Linux 8 8.0p1-19.el8_8

rocky linux advisories RLSA-2023:4419

  • openssh Alpine 3.16 9.0_p1-r4
  • openssh Alpine 3.17 9.1_p1-r4

alpine advisories ALPINE-CVE-2023-38408

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssh CBL-Mariner 2.0 8.9p1-1

azure linux advisories AZL-27651

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-38408 updated cvss 9.8

openssh: Remote code execution in ssh-agent PKCS#11 support

  • Red Hat Devworkspace 1.0 for RHEL 8 devworkspace/devworkspace-rhel8-operator 0.22-2, devworkspace/devworkspace-operator-bundle 0.22-2, devworkspace/devworkspace-project-clone-rhel8 0.22-2
    fixed: vendor fix RHSA-2023:4889
  • Red Hat Enterprise Linux AppStream (v. 8) openssh-askpass 8.0p1-19.el8_8
    fixed: vendor fix RHSA-2023:4419
  • Red Hat Enterprise Linux AppStream (v. 9) openssh-askpass 8.7p1-30.el9_2, pam_ssh_agent_auth 0.10.4-5.30.el9_2
    fixed: vendor fix RHSA-2023:4412
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) openssh-askpass 8.0p1-5.el8_2
    fixed: vendor fix RHSA-2023:4384
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) openssh-askpass 8.0p1-7.el8_4
    fixed: vendor fix RHSA-2023:4381
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) openssh-askpass 8.0p1-5.el8_1.1
    fixed: vendor fix RHSA-2023:4383
  • Red Hat Enterprise Linux AppStream E4S (v. 8.2) openssh-askpass 8.0p1-5.el8_2
    fixed: vendor fix RHSA-2023:4384
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) openssh-askpass 8.0p1-7.el8_4
    fixed: vendor fix RHSA-2023:4381
show 20 more
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) openssh-askpass 8.0p1-15.el8_6
    fixed: vendor fix RHSA-2023:4413
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) openssh-askpass 8.7p1-11.el9_0, pam_ssh_agent_auth 0.10.4-4.11.el9_0
    fixed: vendor fix RHSA-2023:4329
  • Red Hat Enterprise Linux AppStream TUS (v. 8.2) openssh-askpass 8.0p1-5.el8_2
    fixed: vendor fix RHSA-2023:4384
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) openssh-askpass 8.0p1-7.el8_4
    fixed: vendor fix RHSA-2023:4381
  • Red Hat Enterprise Linux BaseOS (v. 8) openssh 8.0p1-19.el8_8, openssh-cavs 8.0p1-19.el8_8, openssh-ldap 8.0p1-19.el8_8, openssh-keycat 8.0p1-19.el8_8, openssh-server 8.0p1-19.el8_8, openssh-clients 8.0p1-19.el8_8, +1 more
    fixed: vendor fix RHSA-2023:4419
  • Red Hat Enterprise Linux BaseOS (v. 9) openssh 8.7p1-30.el9_2, openssh-keycat 8.7p1-30.el9_2, openssh-server 8.7p1-30.el9_2, openssh-clients 8.7p1-30.el9_2
    fixed: vendor fix RHSA-2023:4412
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) openssh 8.0p1-5.el8_2, openssh-cavs 8.0p1-5.el8_2, openssh-ldap 8.0p1-5.el8_2, openssh-keycat 8.0p1-5.el8_2, openssh-server 8.0p1-5.el8_2, openssh-clients 8.0p1-5.el8_2, +1 more
    fixed: vendor fix RHSA-2023:4384
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) openssh 8.0p1-7.el8_4, openssh-cavs 8.0p1-7.el8_4, openssh-ldap 8.0p1-7.el8_4, openssh-keycat 8.0p1-7.el8_4, openssh-server 8.0p1-7.el8_4, openssh-clients 8.0p1-7.el8_4, +1 more
    fixed: vendor fix RHSA-2023:4381
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.1) openssh 8.0p1-5.el8_1.1, openssh-cavs 8.0p1-5.el8_1.1, openssh-ldap 8.0p1-5.el8_1.1, openssh-keycat 8.0p1-5.el8_1.1, openssh-server 8.0p1-5.el8_1.1, openssh-clients 8.0p1-5.el8_1.1, +1 more
    fixed: vendor fix RHSA-2023:4383
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.2) openssh 8.0p1-5.el8_2, openssh-cavs 8.0p1-5.el8_2, openssh-ldap 8.0p1-5.el8_2, openssh-keycat 8.0p1-5.el8_2, openssh-server 8.0p1-5.el8_2, openssh-clients 8.0p1-5.el8_2, +1 more
    fixed: vendor fix RHSA-2023:4384
  • Red Hat Enterprise Linux BaseOS E4S (v.8.4) openssh 8.0p1-7.el8_4, openssh-cavs 8.0p1-7.el8_4, openssh-ldap 8.0p1-7.el8_4, openssh-keycat 8.0p1-7.el8_4, openssh-server 8.0p1-7.el8_4, openssh-clients 8.0p1-7.el8_4, +1 more
    fixed: vendor fix RHSA-2023:4381
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) openssh 8.0p1-15.el8_6, openssh-cavs 8.0p1-15.el8_6, openssh-ldap 8.0p1-15.el8_6, openssh-keycat 8.0p1-15.el8_6, openssh-server 8.0p1-15.el8_6, openssh-clients 8.0p1-15.el8_6, +1 more
    fixed: vendor fix RHSA-2023:4413
  • Red Hat Enterprise Linux BaseOS EUS (v.9.0) openssh 8.7p1-11.el9_0, openssh-keycat 8.7p1-11.el9_0, openssh-server 8.7p1-11.el9_0, openssh-clients 8.7p1-11.el9_0
    fixed: vendor fix RHSA-2023:4329
  • Red Hat Enterprise Linux BaseOS TUS (v. 8.2) openssh 8.0p1-5.el8_2, openssh-cavs 8.0p1-5.el8_2, openssh-ldap 8.0p1-5.el8_2, openssh-keycat 8.0p1-5.el8_2, openssh-server 8.0p1-5.el8_2, openssh-clients 8.0p1-5.el8_2, +1 more
    fixed: vendor fix RHSA-2023:4384
  • Red Hat Enterprise Linux BaseOS TUS (v.8.4) openssh 8.0p1-7.el8_4, openssh-cavs 8.0p1-7.el8_4, openssh-ldap 8.0p1-7.el8_4, openssh-keycat 8.0p1-7.el8_4, openssh-server 8.0p1-7.el8_4, openssh-clients 8.0p1-7.el8_4, +1 more
    fixed: vendor fix RHSA-2023:4381
  • Red Hat Enterprise Linux Client (v. 7) openssh 7.4p1-23.el7_9, openssh-keycat 7.4p1-23.el7_9, openssh-server 7.4p1-23.el7_9, openssh-askpass 7.4p1-23.el7_9, openssh-clients 7.4p1-23.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) openssh-cavs 7.4p1-23.el7_9, openssh-ldap 7.4p1-23.el7_9, pam_ssh_agent_auth 0.10.3-2.23.el7_9, openssh-server-sysvinit 7.4p1-23.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssh-cavs 7.4p1-23.el7_9, openssh-ldap 7.4p1-23.el7_9, openssh-askpass 7.4p1-23.el7_9, pam_ssh_agent_auth 0.10.3-2.23.el7_9, openssh-server-sysvinit 7.4p1-23.el7_9
    fixed: vendor fix RHSA-2023:4382
  • Red Hat Enterprise Linux Server (v. 6 ELS) openssh 5.3p1-125.el6_10, openssh-server 5.3p1-125.el6_10, openssh-askpass 5.3p1-125.el6_10, openssh-clients 5.3p1-125.el6_10
    fixed: vendor fix RHSA-2023:4428
  • Red Hat Enterprise Linux Server (v. 7) openssh 7.4p1-23.el7_9, openssh-keycat 7.4p1-23.el7_9, openssh-server 7.4p1-23.el7_9, openssh-askpass 7.4p1-23.el7_9, openssh-clients 7.4p1-23.el7_9
    fixed: vendor fix RHSA-2023:4382
  • Red Hat Enterprise Linux Server Optional (v. 6 ELS) openssh-ldap 5.3p1-125.el6_10, pam_ssh_agent_auth 0.9.3-125.el6_10
    fixed: vendor fix RHSA-2023:4428
  • Red Hat Enterprise Linux Server Optional (v. 7) openssh-cavs 7.4p1-23.el7_9, openssh-ldap 7.4p1-23.el7_9, pam_ssh_agent_auth 0.10.3-2.23.el7_9, openssh-server-sysvinit 7.4p1-23.el7_9 Red Hat Enterprise Linux Workstation (v. 7) openssh 7.4p1-23.el7_9, openssh-keycat 7.4p1-23.el7_9, openssh-server 7.4p1-23.el7_9, openssh-askpass 7.4p1-23.el7_9, openssh-clients 7.4p1-23.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) openssh-cavs 7.4p1-23.el7_9, openssh-ldap 7.4p1-23.el7_9, pam_ssh_agent_auth 0.10.3-2.23.el7_9, openssh-server-sysvinit 7.4p1-23.el7_9
    fixed: vendor fix RHSA-2023:4382

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 7.7

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-105-08 updated cvss 8.8

ABB M2M Gateway

  • ABB M2M Gateway >=4.1.2, <=5.0.3, >=5.0.1, <=5.0.3
    affected: mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

79.70% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • qualys.com https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://www.openwall.com/lists/oss-security/2023/07/20/1 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
julia OpenSSH_jll
<9.3.2+0
9.3.2+0

Affected products

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
  • CWE-428 Unquoted Search Path or Element

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.