CVE-2023-51384

In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.

References

Affected packages

Git / github.com/openssh/openssh-portable

Affected ranges

Type: GIT
Repo: https://github.com/openssh/openssh-portable
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

881d9c6af9da4257c69c327c4e2f1508b2fa754b

Affected versions

Other

ABOUT_TO_ADD_INET_ATON

AFTER_FREEBSD_PAM_MERGE

AFTER_KRB5_GSSAPI_MERGE

BEFORE_FREEBSD_PAM_MERGE

BEFORE_KRB5_GSSAPI_MERGE

POST_KRB4_REMOVAL

PRE-REORDER

PRE_CYGWIN_MERGE

PRE_DAN_PATCH_MERGE

PRE_FIXPATHS_INTEGRATION

PRE_HPUX_INTEGRATION

PRE_IPV6

PRE_KRB4_REMOVAL

PRE_NEW_LOGIN_CODE

PRE_SW_KRBV

V_1_2PRE17

V_1_2_1_PRE18

V_1_2_1_PRE19

V_1_2_1_PRE20

V_1_2_1_PRE21

V_1_2_1_PRE22

V_1_2_1_PRE23

V_1_2_1_PRE24

V_1_2_1_PRE25

V_1_2_1_PRE26

V_1_2_1_PRE27

V_1_2_2

V_1_2_2_P1

V_1_2_2_PRE28

V_1_2_2_PRE29

V_1_2_3

V_1_2_3_PRE1

V_1_2_3_PRE2

V_1_2_3_PRE3

V_1_2_3_PRE4

V_1_2_3_PRE5

V_1_2_3_TEST1

V_1_2_3_TEST2

V_1_2_3_TEST3

V_1_2_PRE10

V_1_2_PRE11

V_1_2_PRE12

V_1_2_PRE13

V_1_2_PRE14

V_1_2_PRE15

V_1_2_PRE16

V_1_2_PRE4

V_1_2_PRE5

V_1_2_PRE6

V_1_2_PRE7

V_1_2_PRE8

V_1_2_PRE9

V_2_0_0_BETA1

V_2_0_0_BETA2

V_2_0_0_TEST1

V_2_1_0

V_2_1_0_P1

V_2_1_0_P2

V_2_1_0_P3

V_2_1_1_P1

V_2_1_1_P2

V_2_1_1_P3

V_2_1_1_P4

V_2_2_0_P1

V_2_3_0_P1

V_2_5_0_P1

V_2_5_1_P1

V_2_5_1_P2

V_2_5_2_P1

V_3_0_1_P1

V_3_0_P1

V_3_1_P1

V_3_2_2_P1

V_3_4_P1

V_3_6_1_P1

V_3_8_P1

V_3_9_P1

V_4_2_P1

V_5_0_P1

V_5_1_P1

V_5_2_P1

V_5_5_P1

V_5_7_P1

V_6_0_P1

V_6_1_P1

V_6_2_P1

V_6_5_P1

V_6_6_P1

V_6_8_P1

V_6_9_P1

V_7_0_P1

V_7_1_P1

V_7_2_P1

V_7_3_P1

V_7_4_P1

V_7_5_P1

V_7_6_P1

V_7_7_P1

V_7_8_P1

V_7_9_P1

V_8_0_P1

V_8_1_P1

V_8_2_P1

V_8_4_P1

V_8_5_P1

V_8_6_P1

V_8_7_P1

V_8_8_P1

V_8_9_P1

V_9_0_P1

V_9_1_P1

V_9_2_P1

V_9_3_P1

V_9_5_P1

Database specific

{
    "vanir_signatures": [
        {
            "signature_version": "v1",
            "target": {
                "file": "ssh-agent.c"
            },
            "signature_type": "Line",
            "source": "https://github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b",
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "165133495389554297912767730419079343328",
                    "51357999955434305010492097827526105056",
                    "237719418229141719700376624699526783696",
                    "222509662087054981858724365674461944310",
                    "77877875258432041824660753117188147160",
                    "260180419508842306242026762219675778977",
                    "319395782123128356350823936054264886001",
                    "172655592712497241375021799634740338404",
                    "183399105187236692764150687158924405640",
                    "13300799163786537476821050767830715023",
                    "221711053435872488017755765670535943696",
                    "291311572882749541789877283323457299620",
                    "210924518203033044114707095992339301332",
                    "19911762018547012148449969924601994575",
                    "277594480068207267620304023861492235757",
                    "250061180844054679988232107686823032932",
                    "187077904320853389933675193085424106859",
                    "205896619791922447934686386543737829507",
                    "45893456774503555158027456471775856766",
                    "288516979117290764510509880060259271743",
                    "132582832762637166722279977939824181863",
                    "97735314150398434170463706927390337055",
                    "307173292080022353125029275547071352355",
                    "92036182733966272299927009172134763297",
                    "22940543327438639525058052641308751744",
                    "252438227409640733494615835613228794155",
                    "202457347594211403788944331955161749688"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2023-51384-04095291"
        },
        {
            "signature_version": "v1",
            "target": {
                "function": "process_request_identities",
                "file": "ssh-agent.c"
            },
            "signature_type": "Function",
            "source": "https://github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b",
            "deprecated": false,
            "digest": {
                "length": 950.0,
                "function_hash": "175177923229075572065215605283815395961"
            },
            "id": "CVE-2023-51384-25d81cb7"
        },
        {
            "signature_version": "v1",
            "target": {
                "function": "process_add_identity",
                "file": "ssh-agent.c"
            },
            "signature_type": "Function",
            "source": "https://github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b",
            "deprecated": false,
            "digest": {
                "length": 2617.0,
                "function_hash": "214910033270401005651023148364417079835"
            },
            "id": "CVE-2023-51384-344f481f"
        },
        {
            "signature_version": "v1",
            "target": {
                "function": "process_add_smartcard_key",
                "file": "ssh-agent.c"
            },
            "signature_type": "Function",
            "source": "https://github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b",
            "deprecated": false,
            "digest": {
                "length": 1972.0,
                "function_hash": "149225205320621043989436734866009309103"
            },
            "id": "CVE-2023-51384-c3bcb8ae"
        }
    ]
}