OpenSSH · CVSS 8.1 · published 1 July 2024
regreSSHion: CVE-2024-6387
A race condition in the OpenSSH server's signal handler that can let a remote attacker run code as root without logging in, on glibc-based Linux. The bug returned in OpenSSH 8.5p1 after being fixed in 2006, hence the name. Below is its status on each Linux distribution past end of life, from the vendors' own security trackers.
- 0end-of-life systems without a free fix
- 9fixed or not affected
regreSSHion on end-of-life Linux
| Distribution | Status | Details |
|---|---|---|
| CentOS 6 | Not affected | Red Hat security data |
| CentOS 7 | Not affected | Red Hat security data |
| RHEL 7 | Not affected | Red Hat security data |
| CentOS 8 | Not affected | Red Hat security data |
| Ubuntu 16.04 | Not affected | introduced in v8.5p1 |
| Ubuntu 18.04 | Not affected | introduced in v8.5p1 |
| Ubuntu 20.04 | Not affected | introduced in v8.5p1 |
| Debian 10 | Not affected | upstream 7.9p1 is outside the affected range |
| Debian 11 | Not affected | Debian security tracker |
From the Red Hat security data (CentOS and RHEL), the Ubuntu CVE tracker and the Debian security tracker, 29 October 2026. CentOS received Red Hat's fixes only until its own end of life; later fixes went to paid Red Hat support. Fixes marked Ubuntu Pro need a paid subscription. Where a tracker has no entry, the version in the distribution's repository is checked against the NVD range.
The OpenSSH versions we track
| Version | CVE-2024-6387 |
|---|---|
| OpenSSH 5.3p1 | Not affected |
| OpenSSH 7.2p2 | Not affected |
| OpenSSH 7.4p1 | Not affected |
| OpenSSH 7.6p1 | Not affected |
| OpenSSH 7.9p1 | Not affected |
| OpenSSH 8.0p1 | Not affected |
| OpenSSH 8.2p1 | Not affected |
| OpenSSH 8.4p1 | Not affected |
For the upstream version, according to the US National Vulnerability Database. A distribution package may carry its own fix; the table above shows that.
What the NVD record says
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
Score 8.1 (High), published 1 July 2024. Read the NVD entry
Affected upstream versions of OpenSSH
- openssh before 4.4
- openssh from 8.6 up to 9.8
- openssh version 4.4
- openssh version 8.5
- openssh version 8.6
What you can do
Keep OpenSSH, patched
Where the table shows no free fix, we backport it to the package you run, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a supported release once your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.