Named vulnerabilities on end-of-life systems
The flaws with names are the ones auditors and boards ask about. For each one: what it is, and its status on every Linux distribution past end of life, from the vendors' own security trackers.
Request a server assessmentThe named vulnerabilities
| Name | CVE | Component | Score | Exploited | No free fix on |
|---|---|---|---|---|---|
| regreSSHion | CVE-2024-6387 | OpenSSH | 8.1 | No | 0 of 9 |
| xz backdoor | CVE-2024-3094 | xz-utils | 10.0 | No | 0 of 9 |
| Terrapin | CVE-2023-48795 | SSH (OpenSSH) | 5.9 | No | 6 of 9 |
| Looney Tunables | CVE-2023-4911 | glibc | 7.8 | Yes | 1 of 9 |
| Spring4Shell | CVE-2022-22965 | Spring Framework | 9.8 | Yes | 2 of 9 |
| Dirty Pipe | CVE-2022-0847 | Linux kernel | 7.8 | Yes | 1 of 9 |
| PwnKit | CVE-2021-4034 | polkit (pkexec) | 7.8 | Yes | 3 of 9 |
| Log4Shell | CVE-2021-44228 | Apache Log4j 2 | 10.0 | Yes | 1 of 9 |
| Baron Samedit | CVE-2021-3156 | sudo | 7.8 | Yes | 1 of 9 |
| Ghostcat | CVE-2020-1938 | Apache Tomcat (AJP) | 9.8 | Yes | 2 of 9 |
| Drupalgeddon 2 | CVE-2018-7600 | Drupal core | 9.8 | Yes | 0 of 9 |
| Dirty COW | CVE-2016-5195 | Linux kernel | 7.0 | Yes | 0 of 9 |
| GHOST | CVE-2015-0235 | glibc | 10.0 | No | 0 of 9 |
| Shellshock | CVE-2014-6271 | bash | 9.8 | Yes | 0 of 9 |
| Heartbleed | CVE-2014-0160 | OpenSSL | 7.5 | Yes | 0 of 9 |
| PHP2Shell | CVE-2026-109618 | PHP | 9.8 | Yes | see the page |
No free fix on: how many of the 9 end-of-life releases we follow (CentOS 6, 7 and 8, RHEL 7, Ubuntu 16.04 to 20.04, Debian 10 and 11) are affected with no fix, or with a fix only in paid vendor support. Exploited: listed in the CISA catalogue of known exploited vulnerabilities.
End-of-life Linux
What each distribution still runs, and when its support ended. End-of-life Linux
Patch on order, 48 h
We backport the fix to the version you run within 48 hours of your order, or within 24 hours with priority delivery. See the plans