How do I check which servers run an OpenSSH version affected by a new CVE?

Start with the version each server announces, then confirm against the vendor's patch status, because the announcement alone can mislead. Every SSH server sends an identification string such as SSH-2.0-OpenSSH_9.6p1 before anything else, and a scanner or a simple connection shows it. Compare that version with the range in the advisory. For regreSSHion (CVE-2024-6387), for example, the advisory published by Qualys on 1 July 2024 named OpenSSH from 8.5p1 up to, but not including, 9.8p1 on glibc-based Linux. Then check the package version on each server: Linux distributions often backport security fixes into an older version number, so a server announcing an affected version may already be patched, and the distribution's security tracker is the authority. Patch through the package manager, restart the service and check again. Keep a list of SSH servers from your inventory, so that the next advisory takes minutes rather than days.

← All 40 questions on Encryption and encrypted trafficAll topics