CVE-2023-28531Critical· 9.8▾ Midnightssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.6 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
2.3%
Last analysed / modified upstream
2.3% → 3.0%
ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.
openssh >= 8.9, < 9.3brocade_fabric_operating_systemhci_bootstrap_ossolidfire_element_osUpgrade past the affected range:
openssh 9.3Connected by shared product, vendor, weakness, or advisory.
CVE-2023-51384Medium· 5.5In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied
CVE-2023-51385Medium· 6.5In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations
CVE-2021-41617High· 7.0sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected
CVE-2023-48795Medium· 5.9The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), a…
CVE-2023-38408Critical· 9.8The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system
CVE-2023-25136Medium· 6.5OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling