Are we affected by OpenSSH flaws such as regreSSHion?

Only if a server runs an affected OpenSSH version in an affected configuration, so start by finding every SSH server you have. regreSSHion (CVE-2024-6387), published in July 2024, affects the OpenSSH server on glibc-based Linux from version 8.5p1 up to, but not including, 9.8p1, as well as very old releases before 4.4p1; other flaws have other ranges, so read each advisory. List your servers from your inventory and from the network, including appliances, containers and forgotten test machines. Check the installed package against your distribution's security tracker, because distributions often backport fixes without changing the version number, then patch, or restrict access until you can. From the Pro plan, the NQCI cryptographic inventory, in preview, lists every SSH server whose version banner it has seen, with the version announced; it needs packet capture, switched on for a Linux agent or a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it./TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. sensor. A banner is a hint, not a verdict, so confirm on the server.

← All 40 questions on Remote work and exposed servicesAll topics