ZeroDay Findings
Sign inSign up

Findings

CVE-2023-38408

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an…

Published Jul 20, 2023 · updated Oct 15, 2026 · openbsd openssh

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 20, 2023 · NIST NVD

    Detected

    The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

  2. Oct 15, 2026 · NIST NVD

    Updated

    The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

Affected

  • cpe fedoraproject/fedora37
  • cpe fedoraproject/fedora38
  • cpe openbsd/opensshversion unspecified
  • cpe openbsd/openssh9.3

Sources

  • CVE.orgCVE-2023-38408

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-38408

    30-day exploitation probability 79.7%

    first.org
  • NIST NVDCVE-2023-38408

    The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this is

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References