CVE-2023-51384

    Dashboard / Vulnerabilities / CVE-2023-51384

    CVE-2023-51384

    Published: 18 Dec 2023Last Modified: 9 Sept 2026

    Summary:

    Details: In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.

    References: https://cert-portal.siemens.com/productcert/html/ssa-019113.html, https://cert-portal.siemens.com/productcert/html/ssa-082556.html, https://cert-portal.siemens.com/productcert/html/ssa-769027.html, https://cert-portal.siemens.com/productcert/html/ssa-794697.html, https://support.apple.com/kb/HT214084, https://www.openssh.com/txt/release-9.6, https://www.openwall.com/lists/oss-security/2023/12/18/2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51384.json, https://nvd.nist.gov/vuln/detail/CVE-2023-51384, https://security.netapp.com/advisory/ntap-20240105-0005/, https://www.debian.org/security/2023/dsa-5586, https://github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b, http://seclists.org/fulldisclosure/2024/Mar/21

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 166456cedad3962b83b848b1e9caf80794831f0f
    Fixed -8241b9c0529228b4b86d88b1a6076fb9f97e4a99

    Affected versions

    V_9_5_P1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-51384 | CVE-DB