Technical Advisory · Retrospective 2024
regreSSHion: verify the running server, not just an OpenSSH version string
A pre-authentication race condition showed why SSH keys, package backports and server patch state belong in separate checks.
CVE-2024-6387
Technical coverage, source documents and official vulnerability records.
FISRO coverage
Read the relevant deployment conditions, remediation steps and limits of the evidence in the linked material.
Sources from this coverage
- OpenSSH 9.8 release notesOpenSSH project
- regreSSHion: unauthenticated remote code execution in OpenSSH's serverQualys Threat Research Unit
- CVE-2024-6387 product impact bulletinPalo Alto Networks
- Debian CVE-2024-6387 trackerDebian Security Team
- Ubuntu CVE-2024-6387 recordUbuntu Security Team