{"slug":"regresshion","title":"regreSSHion (CVE-2024-6387)","shortName":"regreSSHion","summary":"Signal-handler race condition in OpenSSH server (sshd) on glibc-based Linux that can yield unauthenticated remote code execution as root. CVSS 8.1. Qualys demonstrated exploitability in the lab. Broad downstream blast radius across distros and appliances. Not in CISA KEV as of 23 Oct 2026.","isExample":false,"draft":false,"family":"regresshion","kind":"shared-component","aliases":["CVE-2024-6387","regreSSHion","OpenSSH SIGALRM race"],"publishedAt":"2024-07-01","updatedAt":"2026-10-24","patchStatus":"patched","exploited":false,"scores":{"cve":"CVE-2024-6387","cvss":{"cve":"CVE-2024-6387","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"nvd","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-6387","sourceDate":"2026-10-15","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2024-6387","score":0.99506,"percentile":0.99946,"date":"2026-10-23","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-6387","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2024-6387","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"high"},"managementSummary":{"what":"OpenSSH signal-handler race (CVE-2024-6387) that can yield unauthenticated root remote code execution on glibc Linux. Shown in the lab by Qualys. Not in CISA KEV and not recorded as exploited on this page.","action":"Confirm OpenSSH or vendor packages are patched, and keep sshd off the public internet where you can."},"seenInTheWild":[{"metric":"possibly-vulnerable","value":"over 14 million potentially vulnerable OpenSSH server instances exposed","observer":"Qualys (using Censys and Shodan)","date":"2024-07-01","method":"Version-based Censys/Shodan searches","sourceUrl":"https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server"},{"metric":"exposed","value":38219102,"observer":"Shodan","date":"2026-10-23","method":"Product query product:\"OpenSSH\"","sourceUrl":"https://www.shodan.io/search?query=product%3A%22OpenSSH%22","note":"Exposed hosts. Data: Shodan."}],"seenInTheWildLinks":[{"title":"Shadowserver report","url":"https://www.shadowserver.org/what-we-do/network-reporting/accessible-ssh-report/","observer":"Shadowserver","metric":"exposed"}],"whatChanged":{"date":"2026-10-24","items":[{"text":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","section":"priority","addedDate":"2026-10-24"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","section":"detection","addedDate":"2026-10-24"}]},"whatTheBugIs":"regreSSHion is Qualys's name for CVE-2024-6387, a signal-handler race condition in OpenSSH's server (sshd). If a client does not authenticate within LoginGraceTime (120 seconds by default), sshd's SIGALRM handler runs asynchronously and calls functions that are not async-signal-safe, such as syslog(), on glibc-based Linux. An unauthenticated remote attacker may obtain code execution as root.\n\nOpenSSH 9.8 (released 1 Jul 2024) fixes the issue. Portable OpenSSH versions 8.5p1 through 9.7p1 (inclusive) are vulnerable. Versions from 4.4p1 up to but not including 8.5p1 are not vulnerable to this regression. OpenBSD is not vulnerable. Qualys demonstrated successful exploitation on 32-bit Linux/glibc with ASLR under lab conditions (about 6-8 hours of continuous connections). Exploitation on 64-bit systems was believed possible but not demonstrated at disclosure.\n\nQualys identified over 14 million potentially vulnerable OpenSSH server instances exposed to the internet via Censys and Shodan searches. The bug is a regression of CVE-2006-5051.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"connect","label":"Many connections","detail":"Attacker opens many unauthenticated SSH connections that sit until LoginGraceTime."},{"id":"alarm","label":"SIGALRM race","detail":"The SIGALRM handler runs and calls async-signal-unsafe functions in a racy way."},{"id":"corrupt","label":"Memory corruption","detail":"The race can corrupt memory in sshd. ASLR and timing make reliable exploitation hard."},{"id":"root","label":"Root code exec","detail":"Successful exploitation yields code execution as root. Conceptual impact class only."}]},"exploitation":{"kev":{"listed":false,"date":"2026-10-21","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Last verified 23 Oct 2026 against CISA KEV catalog 2026.10.21. CVE-2024-6387 is not listed."},"firstSeen":{"date":null,"note":"No authoritative source in the pack confirms in-the-wild compromise. Qualys demonstrated a working exploit privately to the OpenSSH team and did not release it."},"vendorStatements":[{"vendor":"OpenSSH","date":"2024-07-01","statement":"A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges. OpenBSD is not vulnerable.","url":"https://www.openssh.com/txt/release-9.8","retracted":false},{"vendor":"Qualys","date":"2024-07-01","statement":"Qualys has developed a working exploit for the regreSSHion vulnerability. We do not release our exploits, as we must allow time for patches to be applied.","url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server","retracted":false}]},"timeline":[{"date":"2024-07-01","event":"OpenSSH 9.8 is released with the sshd race-condition fix. Qualys publishes regreSSHion.","source":{"title":"OpenSSH 9.8 release notes","url":"https://www.openssh.com/txt/release-9.8","publisher":"OpenSSH"},"kind":"patch","key":true},{"date":"2024-07-01","event":"Ubuntu publishes fixed openssh packages for noble, mantic, and jammy.","source":{"title":"Ubuntu CVE-2024-6387","url":"https://ubuntu.com/security/CVE-2024-6387","publisher":"Ubuntu"},"kind":"vendor","key":true},{"date":"2024-07-01","event":"Amazon Linux 2023 ships ALAS2023-2024-649. AL1/AL2 stated not affected (OpenSSH 7.4p1).","source":{"title":"ALAS CVE-2024-6387","url":"https://explore.alas.aws.amazon.com/CVE-2024-6387.html","publisher":"Amazon Linux"},"kind":"vendor","key":true},{"date":"2024-07-02","event":"Cisco publishes a multi-product regreSSHion advisory.","source":{"title":"Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024","publisher":"Cisco"},"kind":"vendor","key":true},{"date":"2024-07-03","event":"Red Hat ships RHSA-2024:4312 for RHEL 9. RHEL 6/7/8 stated not affected.","source":{"title":"Red Hat CVE-2024-6387","url":"https://access.redhat.com/security/cve/cve-2024-6387","publisher":"Red Hat"},"kind":"vendor","key":true},{"date":"2024-07-09","event":"Fortinet publishes FG-IR-24-258 with product-specific fixed releases; FortiOS stated not impacted.","source":{"title":"OpenSSH regreSSHion Attack (CVE-2024-6387)","url":"https://www.fortiguard.com/psirt/FG-IR-24-258","publisher":"Fortinet"},"kind":"vendor","key":true}],"defenderActions":[{"title":"Upgrade OpenSSH / apply vendor packages","detail":"Move to OpenSSH 9.8p1 or later, or install your distribution or vendor patch (for example Ubuntu 1:9.6p1-3ubuntu13.3 on 24.04, RHEL 9 RHSA-2024:4312, Amazon Linux 2023 ALAS2023-2024-649).","priority":"now","links":[{"label":"OpenSSH 9.8 release notes","href":"https://www.openssh.com/txt/release-9.8"}]},{"title":"Interim LoginGraceTime workaround if you cannot patch","detail":"Ubuntu documents setting LoginGraceTime 0 in sshd_config. That avoids the race but makes sshd vulnerable to MaxStartups exhaustion DoS. Prefer patching.","priority":"soon","links":[{"label":"Ubuntu CVE-2024-6387","href":"https://ubuntu.com/security/CVE-2024-6387"}]},{"title":"Restrict SSH exposure","detail":"Limit sshd to trusted networks or require a bastion/VPN. Qualys reported multi-million-scale internet exposure of potentially vulnerable instances.","priority":"soon"},{"title":"Patch appliances that ship OpenSSH","detail":"Cisco, Fortinet, and others published product advisories. Appliance OpenSSH is not covered by the host OS package alone.","priority":"soon"}],"detection":[{"title":"Burst of unauthenticated SSH connections to LoginGraceTime","detail":"Lab exploitation required many connections held until LoginGraceTime. Alert on sustained unauthenticated SSH connection storms against the same listener.","logSource":"SSH / network telemetry","kind":"generic","group":"web-proxy"},{"title":"sshd crashes or unexpected restarts","detail":"Failed or partial race attempts may crash sshd. Correlate sshd process crashes with connection storms.","logSource":"EDR / process telemetry","kind":"generic","group":"edr"},{"title":"Cisco Talos Snort: 1:33654, 1:63659","detail":"Cisco advisory lists Snort rules 33654 and 63659 to help detect exploitation of CVE-2024-6387. Rule doc 1:33654 references CVE-2024-6387.","logSource":"Snort / Cisco Secure Firewall IPS event logs","kind":"vendor-signature","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024","date":"2024-07-01"},{"title":"Fortinet FortiGuard IPS: 56106","detail":"IPS signature OpenSSH.sshd.SIGALRM.Handler.Race.Condition (56106), 2024-07-03.","logSource":"FortiGate IPS logs","kind":"vendor-signature","url":"https://www.fortiguard.com/search?q=CVE-2024-6387&engine=1","date":"2024-07-03"},{"title":"Juniper IDP: SSH:OPENSSH:RACE-SIGNAL-RCE","detail":"IDP signature referencing CVE-2024-6387, release date 2024-08-23, recommended action Drop.","logSource":"Juniper SRX IDP logs","kind":"vendor-signature","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.SSH:OPENSSH:RACE-SIGNAL-RCE.html","date":"2024-08-23"},{"title":"Sophos Firewall IPS: OpenSSH Race Condition in Signal Handler CVE-2024-6387","detail":"Listed in IPS release 18.22.42 (2024-09-12). No SID in the notes.","logSource":"Sophos Firewall IPS logs","kind":"vendor-signature","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.22.42.html","date":"2024-09-12"},{"title":"Zscaler ATP / Cloud Firewall: SSH.Exploit.CVE-2024-6387","detail":"Advanced Threat Protection and Advanced Cloud Firewall signature SSH.Exploit.CVE-2024-6387.","logSource":"Zscaler ZIA firewall / threat logs","kind":"vendor-signature","url":"https://www.zscaler.com/blogs/security-research/openssh-vulnerabilities-cve-2024-6387-cve-2024-6409-pose-significant","date":"2024-08-05"}],"detectionRules":[{"id":"splunk-blog-regresshion-timeout-before-auth","title":"Timeout before authentication by host","language":"spl","query":"sourcetype=journald OR sourcetype=linux:auth OR TERM(sshd) OR TERM(ssh)\nTERM(Timeout) TERM(authentication) \"Timeout before authentication\"\n| timechart count by host","logSource":"sshd auth logs (journald / linux:auth)","author":"Splunk Threat Research Team","authorUrl":"https://research.splunk.com/","sourceUrl":"https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html","sourceDate":"2024-07-02","license":"Posted publicly; see source","origin":"vendor","notes":"Look for spikes on hosts still on OpenSSH 8.5p1 to 9.7p1.","tested":"untested"},{"id":"slimkql-regresshion-ssh-connection-volume","title":"KQL for detecting potential RegreSSHion abuse","language":"kql","query":"// KQL for detecting potential hashtag#RegreSSHion abuse\n// https://www.linkedin.com/posts/activity-7214588446722465792-FwFr/\n\n// ** Assumption **\n// Firewall logs stream to CommonSecurityLog \n// 6 OpenSSH connections per min for minimum 6 hours\n// 6x60x6 = 2160 connections for past 6 hours\n// Attack source is non-distributed, triangulate by country level\n// Feel free to adjust the assumption parameters to your environment needs\n\nCommonSecurityLog\n| where TimeGenerated >= ago (6h)\n| where DestinationPort == \"22\"\n| extend ip_location=geo_info_from_ip_address(SourceIP)\n| extend Country=tostring(ip_location.country)\n| where Country != \"\"\n| summarize SSH_Connection=count() by Country \n| sort by SSH_Connection desc\n| where SSH_Connection > 2160\n\n// If analytics rule get triggered, this probably warrant a deeper investigation","logSource":"Firewall logs in Microsoft Sentinel CommonSecurityLog","author":"Steven Lim (@0x534c)","authorUrl":"https://x.com/0x534c","sourceUrl":"https://github.com/SlimKQL/Hunting-Queries-Detection-Rules/blob/db0fdb0e187788e4a97e2a0b57d339e653019e84/Sentinel/KQL%20for%20detecting%20potential%20hashtag%23RegreSSHion%20abuse.kql","sourceDate":"2024-08-25","license":"BSD-3-Clause (repo LICENSE)","origin":"community","notes":"Excerpt; the file's MITRE mapping comments are omitted. Author asks for credit to Steven Lim / @SlimKQL when reused.","tested":"untested"},{"id":"slimkql-regresshion-internet-facing-openssh","title":"DefenderXDR Exposure Management for RegreSSHion","language":"kql","query":"// DefenderXDR Exposure Management for hashtag#RegreSSHion\n// https://www.linkedin.com/posts/activity-7214788756237639680-rGkW/\n\n//Use below KQL to determine your internet facing VM with OpenSSH and prioritize the following:\n// - Access Control\n// - Host-based Intrusion Prevention (E.g fail2ban)\n// - SSH Configuration Hardening\n// (E.g LoginGraceTime/MaxStartups/PerSourceMaxStartups)\n\n// Refer to Splunk Mitigation Strategies for CVE-2024-6387\n// Link: https://lnkd.in/gFPsbcaW\n\nlet InternetFacingVM=\nExposureGraphNodes\n| where NodeLabel == 'device' or (Categories has 'virtual_machine' and set_has_element(Categories, 'virtual_machine'))\n| where NodeProperties.rawData.isInternetFacing == true\n| extend InternetFacingDeviceName=tostring(NodeProperties.rawData.deviceName)\n| project InternetFacingDeviceName;\nDeviceTvmSoftwareInventory\n| where SoftwareName contains \"openssh\"\n| where DeviceName has_any(InternetFacingVM)","logSource":"Microsoft Defender XDR ExposureGraphNodes and DeviceTvmSoftwareInventory","author":"Steven Lim (@0x534c)","authorUrl":"https://x.com/0x534c","sourceUrl":"https://github.com/SlimKQL/Hunting-Queries-Detection-Rules/blob/db0fdb0e187788e4a97e2a0b57d339e653019e84/DefenderXDR/DefenderXDR%20Exposure%20Management%20for%20hashtag%23RegreSSHion.kql","sourceDate":"2024-08-25","license":"BSD-3-Clause (repo LICENSE)","origin":"community","notes":"Excerpt; MITRE comments omitted. Lists internet-facing devices with OpenSSH installed, for prioritising.","tested":"untested"},{"id":"v2s-sigma-sshd-timeout-before-auth","title":"OpenSSH Timeout Before Authentication","language":"sigma","query":"title: OpenSSH Timeout Before Authentication\nid: 02a549cd-caf6-5a1e-bb3d-3652385d99ec\nstatus: experimental\ndescription: Matches sshd \"Timeout before authentication\" messages. Exploiting CVE-2024-6387 (regreSSHion) needs thousands of connections held until LoginGraceTime, so a sharp rise in these messages on an unpatched host is the signal. Alert on volume per host or source, not single events.\nreferences:\n    - https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html\n    - https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt\nauthor: vuln2shell\ndate: 2026-10-23\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - cve.2024-6387\nlogsource:\n    product: linux\n    service: sshd\ndetection:\n    keywords:\n        - 'Timeout before authentication'\n    condition: keywords\nfalsepositives:\n    - Internet scanners and brute-force noise also produce this message\nlevel: low","logSource":"sshd auth logs (auth.log / secure / journald)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html","sourceDate":"2024-07-02","license":"CC0 1.0","origin":"vuln2shell","notes":"Sigma form of the Splunk blog search. Pair it with a count threshold in your SIEM.","tested":"untested"},{"id":"v2s-logscale-sshd-timeout-before-auth","title":"OpenSSH Timeout before authentication by source (LogScale)","language":"logscale","query":"\"Timeout before authentication\"\n| regex(\"for (?<src_ip>\\S+) port\")\n| groupBy([src_ip], function=count(as=timeouts))\n| sort(timeouts, order=desc)","logSource":"sshd auth logs ingested into LogScale / Falcon NG-SIEM","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html","sourceDate":"2024-07-02","license":"CC0 1.0","origin":"vuln2shell","notes":"Free-text search, so it works with any Linux auth parser.","tested":"untested"},{"id":"et-openssh-vulnerable-version","title":"ET INFO Server Responded with Vulnerable OpenSSH Version (CVE-2024-6387)","language":"suricata","query":"#alert ssh any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:\"ET INFO Server Responded with Vulnerable OpenSSH Version (CVE-2024-6387)\"; flow:established,to_client; content:\"SSH-\"; startswith; content:\"-OpenSSH_\"; fast_pattern; pcre:\"/^(?:[123]|4\\.(?:[0123](?:p\\d)?|4[^p])|8\\.(?:[6789](?:p\\d)?|5(?:p[^1])?)|9\\.(?:[01234567](?:p\\d)?|8[^p]))(?:\\.\\d)*(?:\\d|p\\d)*/R\"; reference:cve,2024-6387; reference:url,blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server; classtype:successful-recon-largescale; sid:2054218; rev:2; metadata:attack_target Client_and_Server, created_at 2024_07_01, cve CVE_2024_6387, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Significant, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_07_02, former_sid 2857461, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)","logSource":"Suricata SSH inspection","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-info.rules","sourceDate":"2024-07-02","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","notes":"Flags servers whose banner shows a vulnerable OpenSSH version. Distro backports can make patched builds match. Ships commented out (disabled) in ET Open; enable it to use it.","tested":"untested"}],"detectionLinks":[{"title":"Qualys: regreSSHion technical advisory","url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","author":"Qualys Threat Research Unit","date":"2024-07-01"},{"title":"Splunk: regreSSHion detection and mitigation","url":"https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html","author":"Splunk Threat Research Team","date":"2024-07-02","note":"Also has an OpenSSH package inventory search."},{"title":"Steven Lim: Leveraging Sentinel UEBA to safeguard against OpenSSH exploits","url":"https://github.com/SlimKQL/Hunting-Queries-Detection-Rules/blob/db0fdb0e187788e4a97e2a0b57d339e653019e84/Sentinel/Leveraging%20Sentinel%20UEBA%20to%20safeguard%20against%20OpenSSH%20vulnerability%20exploits.kql","author":"Steven Lim (@0x534c)","date":"2024-08-25"},{"title":"Steven Lim: Azure Resource Graph check for Linux VMs running OpenSSH","url":"https://github.com/SlimKQL/Hunting-Queries-Detection-Rules/blob/db0fdb0e187788e4a97e2a0b57d339e653019e84/Azure/regreSSHion%20-%20Remote%20Unauthenticated%20Code%20Execution%20Vulnerability%20in%20OpenSSH%20server.kql","author":"Steven Lim (@0x534c)"}],"retrohunt":{"summary":"There is no public working exploit and no confirmed in-the-wild compromise. Retrohunt for a sharp rise in sshd Timeout before authentication messages from 1 Jul 2024, and for sshd crashes on unpatched hosts.","lookback":{"from":"2024-07-01","basis":"public-disclosure","rationale":"Qualys disclosed on 1 Jul 2024 and did not release its exploit. No authoritative source confirms ITW compromise. Start at disclosure unless your exposure model needs an earlier window.","sources":[{"url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","date":"2024-07-01","publisher":"Qualys"}]},"logSources":[{"name":"sshd auth logs (auth.log / secure / journald)","why":"Timeout before authentication is the volume signal.","required":true},{"name":"Host crash / core dump telemetry","why":"Failed race attempts can crash sshd.","required":false},{"name":"EDR process telemetry","why":"A successful race would show unexpected child processes of sshd.","required":false}],"steps":[{"title":"Inventory OpenSSH versions","detail":"Qualys lists OpenSSH 8.5p1 through 9.7p1 as the vulnerable range on glibc Linux. Confirm what each host ran in July 2024.","sources":[{"url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","date":"2024-07-01","publisher":"Qualys"}]},{"title":"Search for Timeout before authentication spikes","detail":"Lab exploitation needs thousands of connections held until LoginGraceTime. Alert on a sharp rise per host or source, not on single events.","sources":[{"url":"https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html","date":"2024-07-02","publisher":"Splunk"},{"url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","date":"2024-07-01","publisher":"Qualys"}]},{"title":"Correlate with sshd crashes","detail":"Failed or partial races can crash sshd. Look for restarts and core dumps next to the spike.","sources":[{"url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","date":"2024-07-01","publisher":"Qualys"}]},{"title":"If nothing turns up, stop","detail":"Without a public PoC and without ITW confirmation, absence of these signals is the expected result."}],"queries":[{"id":"v2s-rh-spl-regresshion-timeout","title":"sshd Timeout before authentication spikes since 1 Jul 2024","language":"spl","query":"index=* (sourcetype=linux_secure OR sourcetype=syslog OR sourcetype=journald) earliest=\"07/01/2024:00:00:00\" \"Timeout before authentication\"\n| rex \"for (?<src_ip>\\S+) port\"\n| bin _time span=1h\n| stats count as timeouts by host, src_ip, _time\n| where timeouts > 50\n| sort - timeouts","logSource":"sshd auth logs in Splunk","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html","sourceDate":"2024-07-02","license":"CC0 1.0","origin":"vuln2shell","notes":"Threshold of 50 per hour is a starting point; raise it for noisy bastions.","tested":"untested","timeRange":"From 2024-07-01"},{"id":"v2s-rh-logscale-regresshion-timeout","title":"sshd Timeout before authentication spikes","language":"logscale","query":"// Set the time picker to start 2024-07-01\n\"Timeout before authentication\"\n| regex(\"for (?<src_ip>\\S+) port\")\n| groupBy([#host, src_ip], function=count(as=timeouts), limit=max)\n| timeouts > 50\n| sort(timeouts, order=desc)","logSource":"sshd auth logs in LogScale","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html","sourceDate":"2024-07-02","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2024-07-01"},{"id":"v2s-rh-kql-regresshion-sshd-crash","title":"sshd process crashes since 1 Jul 2024","language":"kql","query":"DeviceProcessEvents\n| where Timestamp >= datetime(2024-07-01)\n| where FileName =~ \"sshd\" and ActionType == \"ProcessTerminated\"\n| summarize Restarts = count() by DeviceName, bin(Timestamp, 1h)\n| where Restarts > 5","logSource":"Microsoft Defender for Endpoint DeviceProcessEvents (Linux)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","sourceDate":"2024-07-01","license":"CC0 1.0","origin":"vuln2shell","notes":"ActionType names vary by sensor; adapt to your schema.","tested":"untested","timeRange":"From 2024-07-01, limited by retention"}],"thirdPartyQueries":[{"title":"Splunk: Timeout before authentication query","url":"https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html","author":"Splunk","date":"2024-07-02","language":"spl","license":"see source","origin":"vendor","note":"Base query adapted above."},{"title":"Sentinel UEBA against OpenSSH exploits","url":"https://github.com/SlimKQL/Hunting-Queries-Detection-Rules/blob/db0fdb0e187788e4a97e2a0b57d339e653019e84/Sentinel/Leveraging%20Sentinel%20UEBA%20to%20safeguard%20against%20OpenSSH%20vulnerability%20exploits.kql","author":"Steven Lim","date":"2024-08-25","language":"kql","license":"see source","origin":"vendor","note":"Already linked from Detection."}],"artefacts":[{"kind":"device-log","value":"sshd: Timeout before authentication for <ip>","detail":"Volume signal for LoginGraceTime storms.","sourceUrl":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","sourceDate":"2024-07-01"},{"kind":"process","value":"sshd crashes or unexpected restarts","detail":"Failed race attempts.","sourceUrl":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","sourceDate":"2024-07-01"}],"iocs":[],"iocNote":"No public IOC list. Qualys did not release its exploit.","hitMeaning":[{"level":"attempt","detail":"A Timeout before authentication spike on an unpatched host."},{"level":"likely-compromise","detail":"A spike plus sshd crashes, or unexpected children of sshd."},{"level":"confirmed-compromise","detail":"Not reported publicly for this CVE. Treat any shell under sshd as a separate investigation."}],"nextSteps":[{"title":"Patch first","detail":"Upgrade to OpenSSH 9.8p1 or the vendor package. LoginGraceTime 0 is only a bridge.","links":[{"label":"OpenSSH 9.8 release","href":"https://www.openssh.com/txt/release-9.8"}]},{"title":"Do not invent compromise","detail":"Without a confirmed shell, treat spikes as scanning."}],"limits":["Internet-facing sshd sees constant LoginGraceTime noise from scanners.","Reliable RCE needs thousands of connections and a matching glibc layout, so false negatives are likely if someone did try."],"sources":[{"url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","date":"2024-07-01","publisher":"Qualys"},{"url":"https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html","date":"2024-07-02","publisher":"Splunk"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"Portable OpenSSH sshd on glibc Linux is in the regression window from 8.5p1 through 9.7p1 inclusive. OpenSSH 9.8 / 9.8p1 (1 Jul 2024) fixes it. 4.4p1 up to but not including 8.5p1 is not vulnerable to this regression. OpenBSD is not vulnerable (OpenSSH 1 Jul 2024). Distro backports can patch 8.5p1-9.7p1 without changing the banner. Ubuntu 20.04 / 18.04 / 16.04 / 14.04 and RHEL 6/7/8 and Amazon Linux 1/2 are vendor-stated not affected. Ubuntu 24.04 is fixed in 1:9.6p1-3ubuntu13.3; 22.04 in 1:8.9p1-3ubuntu0.10; RHEL 9 via RHSA-2024:4312.","checks":[{"id":"v2s-aia-regresshion-version-1","kind":"version","title":"OpenSSH version string","detail":"Qualys and OpenSSH 9.8 notes: Portable OpenSSH 8.5p1-9.7p1 inclusive are in the regression. Fixed in 9.8 / 9.8p1. OpenSSH < 4.4p1 is a separate older race unless patched for CVE-2006-5051 / CVE-2008-4109.","command":"ssh -V; sshd -V 2>&1; dpkg-query -W -f='${Package} ${Version}\\n' openssh-server 2>/dev/null; rpm -q openssh-server 2>/dev/null; apk info -v openssh 2>/dev/null","affectedMeans":"Upstream or unpatched banner 8.5p1 through 9.7p1 on glibc Linux, or a distro package older than the vendor fixed NVR below. Also treat unpatched OpenSSH older than 4.4p1 as in Qualys's older-race row.","fixedMeans":"OpenSSH 9.8p1 or later, or the vendor package: Ubuntu 24.04 1:9.6p1-3ubuntu13.3+, Ubuntu 23.10 1:9.3p1-1ubuntu3.6+, Ubuntu 22.04 1:8.9p1-3ubuntu0.10+, RHEL 9 RHSA-2024:4312 (catalog NVR openssh-0:8.7p1-38.el9_4.1), Amazon Linux 2023 ALAS2023-2024-649. Ubuntu 20.04 and older, RHEL 6/7/8, Amazon Linux 1/2: vendor-stated not affected.","notes":"Banner 9.6p1 on Ubuntu 24.04 can already be the patched 1:9.6p1-3ubuntu13.3. Banner 8.7p1 on RHEL 9 can already be RHSA-2024:4312. Qualys FAQ: unauthenticated banner checks are only potential. Prefer the package manager.","sources":[{"url":"https://www.openssh.com/txt/release-9.8","date":"2024-07-01","publisher":"OpenSSH"},{"url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","date":"2024-07-01","publisher":"Qualys"},{"url":"https://ubuntu.com/security/CVE-2024-6387","date":"2024-07-01","publisher":"Ubuntu"},{"url":"https://access.redhat.com/security/cve/cve-2024-6387","date":"2024-07-01","publisher":"Red Hat"}]},{"id":"v2s-aia-regresshion-package-2","kind":"package","title":"Distro openssh-server package vs vendor fixed NVR","detail":"Splunk 2 Jul 2024 published an inventory search over package audit logs for NAME=*openssh* and flagged version >= 8.5 and < 9.8. Use the package manager first because of backports.","command":"dpkg-query -W -f='${Package} ${Version} ${Architecture}\\n' openssh-server openssh-client 2>/dev/null; rpm -q --qf '%{NAME} %{VERSION}-%{RELEASE} %{ARCH}\\n' openssh-server 2>/dev/null; apt-cache policy openssh-server 2>/dev/null","affectedMeans":"Ubuntu noble older than 1:9.6p1-3ubuntu13.3; jammy older than 1:8.9p1-3ubuntu0.10; mantic older than 1:9.3p1-1ubuntu3.6; RHEL 9 without RHSA-2024:4312. Do not mark Ubuntu focal/bionic/xenial/trusty or RHEL 6/7/8 as affected; vendors stated not affected.","fixedMeans":"Package at or newer than the NVRs in affectedMeans, or OpenSSH 9.8p1+. Ubuntu focal and older: Ubuntu status Not affected. RHEL 6/7/8: Red Hat package_state Not affected.","sources":[{"url":"https://ubuntu.com/security/CVE-2024-6387","date":"2024-07-01","publisher":"Ubuntu"},{"url":"https://access.redhat.com/security/cve/cve-2024-6387","date":"2024-07-01","publisher":"Red Hat"},{"url":"https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html","date":"2024-07-02","publisher":"Splunk"}]},{"id":"v2s-aia-regresshion-config-3","kind":"config","title":"LoginGraceTime effective value (workaround state, not vulnerability)","detail":"The race fires when a client does not authenticate within LoginGraceTime (Qualys: 120 seconds by default, 600 in old OpenSSH). Ubuntu, Qualys, and Red Hat document LoginGraceTime 0 as a workaround. This check only tells you if that workaround is on.","command":"grep -nEi '^[[:space:]]*LoginGraceTime' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* 2>/dev/null; sshd -T 2>/dev/null | grep -i logingracetime","affectedMeans":"Host is still on a vulnerable OpenSSH build AND LoginGraceTime is not 0 (default 120). Workaround is not a patch.","fixedMeans":"Patched package / 9.8p1. If unpatched, LoginGraceTime 0 (sshd -T shows logingracetime 0) is the documented workaround, with the MaxStartups DoS limit below.","notes":"Red Hat: removing LoginGraceTime 0 after you install the update is not automatic; you must edit sshd_config yourself.","sources":[{"url":"https://ubuntu.com/security/CVE-2024-6387","date":"2024-07-01","publisher":"Ubuntu"},{"url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","date":"2024-07-01","publisher":"Qualys"},{"url":"https://access.redhat.com/security/cve/cve-2024-6387","date":"2024-07-01","publisher":"Red Hat"}]},{"id":"v2s-aia-regresshion-exposure-4","kind":"exposure","title":"Internet-facing OpenSSH in your ranges (inventory only)","detail":"Qualys 1 Jul 2024 used Censys and Shodan to count potentially vulnerable OpenSSH instances. Scope every query to your ranges. Banner hits are exposure, not confirmed vulnerable (backports).","command":"shodan search 'product:\"OpenSSH\" net:<your-range>' ; shodan search 'product:\"OpenSSH\" org:\"<your org>\"'","affectedMeans":"A host in your range still serving a banner or package in the 8.5p1-9.7p1 window without a vendor fixed NVR. Do not treat a raw product:OpenSSH hit as vulnerable.","fixedMeans":"No OpenSSH listener in the range, or package/banner shows 9.8p1 or a vendor-stated fixed/not-affected release.","notes":"Catalog Shodan query on 23 Oct 2026 is product:\"OpenSSH\" (exposure count, not CVE-filtered). Qualys CSAM example: software name openssh AND (version<4.4 OR (version<9.8 AND version>=8.5)).","sources":[{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server","date":"2024-07-01","publisher":"Qualys"},{"url":"https://www.shodan.io/search?query=product%3A%22OpenSSH%22","date":"2026-10-23","publisher":"Shodan (catalog check)"}]}],"limits":["Banner and Shodan product:OpenSSH counts include patched-backport and not-affected 7.4p1 hosts. Qualys FAQ: remote unauthenticated QIDs are potential.","OpenBSD is not vulnerable (OpenSSH 1 Jul 2024). Ubuntu 20.04 and older, RHEL 6/7/8, Amazon Linux 1/2 are vendor-stated not affected.","Qualys: Ubuntu 24.04 systemd-socket-activation patch turns off sshd rexec and they believe that release is not exploitable by their approach even before the package fix. Ubuntu still shipped 1:9.6p1-3ubuntu13.3. Do not skip the package.","No public confirmed in-the-wild compromise as of the catalog check 23 Oct 2026 (not in CISA KEV)."],"sources":[{"url":"https://www.openssh.com/txt/release-9.8","date":"2024-07-01","publisher":"OpenSSH"},{"url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","date":"2024-07-01","publisher":"Qualys"},{"url":"https://ubuntu.com/security/CVE-2024-6387","date":"2024-07-01","publisher":"Ubuntu"},{"url":"https://access.redhat.com/security/cve/cve-2024-6387","date":"2024-07-01","publisher":"Red Hat"},{"url":"https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html","date":"2024-07-02","publisher":"Splunk"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server","date":"2024-07-01","publisher":"Qualys"},{"url":"https://www.shodan.io/search?query=product%3A%22OpenSSH%22","date":"2026-10-23","publisher":"Shodan (catalog check)"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"Ubuntu, Qualys, and Red Hat document LoginGraceTime 0 as an interim setting. That avoids the race and opens a MaxStartups denial-of-service. Prefer OpenSSH 9.8p1 or the vendor package.","items":[{"title":"Set LoginGraceTime 0 in sshd_config","detail":"Ubuntu 1 Jul 2024: set LoginGraceTime to 0 in /etc/ssh/sshd_config. Qualys 1 Jul 2024: if sshd cannot be updated or recompiled, set LoginGraceTime to 0. Red Hat: add LoginGraceTime 0 and systemctl restart sshd.service. This avoids the SIGALRM race.","limits":"Ubuntu, Qualys, and Red Hat all say this makes sshd vulnerable to denial of service by exhausting MaxStartups connections. Red Hat: highly recommend fail2ban plus a firewall if you use this. Red Hat: the setting is not removed automatically when you later install the patched package. Prefer OpenSSH 9.8p1 or the vendor package. Qualys: Ubuntu 24.04 socket-activation behaviour is a separate exploitability quirk, not a replacement for this setting or the package.","verify":"grep LoginGraceTime /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ; sshd -T | grep logingracetime. Workaround in place when the effective value is 0. Then confirm sshd was reloaded (systemctl show sshd -p ActiveEnterTimestamp is operational context, not a probe).","source":{"url":"https://ubuntu.com/security/CVE-2024-6387","date":"2024-07-01","publisher":"Ubuntu"}},{"title":"Recompile sshd so sshsigdie() only _exit(1)","detail":"Qualys 1 Jul 2024 Patches and mitigation: if the 9.8 fix is hard to backport, the race can be fixed by removing or commenting out the async-signal-unsafe logging in sshsigdie() so it only _exit(1).","limits":"Requires rebuilding OpenSSH from source. This is a local code change, not a config workaround. Most operators should take the vendor package instead. Not a substitute for 9.8p1 once that package exists.","verify":"Confirm your running sshd binary is the rebuild (package manager or checksum vs the build you signed). There is no sshd_config flag for this change.","source":{"url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","date":"2024-07-01","publisher":"Qualys"}}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"Restrict sshd to trusted networks. Qualys published this as a lab RCE; no public report of attacker persistence on exploited hosts is indexed here.","containment":[{"title":"Restrict sshd to trusted networks or a bastion","detail":"Qualys 1 Jul 2024 immediate steps: limit SSH access through network-based controls. Splunk: firewall allow-lists and jump hosts. This is exposure reduction, not a patch.","sources":[{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server","date":"2024-07-01","publisher":"Qualys"}]},{"title":"If you suspect a successful race, isolate the host as a root compromise","detail":"Qualys impact statement: successful exploitation is unauthenticated RCE as root on glibc Linux. Treat the host as fully untrusted until rebuilt. No public ITW playbook exists.","generic":true,"sources":[{"url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","date":"2024-07-01","publisher":"Qualys"}]}],"rotate":[{"item":"Host SSH host keys, all local passwords, and any credentials or secrets that were on the host (including agent-forwarded material)","reason":"Qualys: a successful race is root on sshd's privileged process. There is no public ITW report of what was stolen. If you have evidence of a shell under sshd, rotate as for root RCE.","generic":true,"sources":[{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server","date":"2024-07-01","publisher":"Qualys"}]}],"evidence":[{"title":"sshd Timeout before authentication volume","detail":"Qualys FAQ 1 Jul 2024: exploitation attempts can be identified by many lines of Timeout before authentication. Splunk 2 Jul 2024 published a timechart on that string. Alert on spikes on unpatched hosts, not single events. Internet scanners also generate this line.","sources":[{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server","date":"2024-07-01","publisher":"Qualys"},{"url":"https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html","date":"2024-07-02","publisher":"Splunk"}]},{"title":"sshd crashes, core dumps, unexpected restarts","detail":"OpenSSH 9.8 notes and Qualys: failed or partial races can crash sshd. Preserve journald / auth.log / secure and coredumpctl listings from 1 Jul 2024.","sources":[{"url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","date":"2024-07-01","publisher":"Qualys"},{"url":"https://www.openssh.com/txt/release-9.8","date":"2024-07-01","publisher":"OpenSSH"}]},{"title":"Unexpected children of sshd and new root-owned files","detail":"No public ITW artefact list. If you investigate a suspected success, preserve process trees and new files before rebuild. Label any specific path you did not read in a public report as unconfirmed.","generic":true}],"sources":[{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server","date":"2024-07-01","publisher":"Qualys"},{"url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","date":"2024-07-01","publisher":"Qualys"},{"url":"https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html","date":"2024-07-02","publisher":"Splunk"},{"url":"https://www.openssh.com/txt/release-9.8","date":"2024-07-01","publisher":"OpenSSH"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"Cisco Talos","title":"Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024","date":"2024-07-01","cve":"CVE-2024-6387"},{"vendor":"Fortinet","title":"FortiGuard search: CVE-2024-6387","url":"https://www.fortiguard.com/search?q=CVE-2024-6387&engine=1","date":"2024-07-03","cve":"CVE-2024-6387"},{"vendor":"Juniper","title":"SSH:OPENSSH:RACE-SIGNAL-RCE","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.SSH:OPENSSH:RACE-SIGNAL-RCE.html","date":"2024-08-23","cve":"CVE-2024-6387"},{"vendor":"Sophos","title":"Sophos IPS signature update 18.22.42","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.22.42.html","date":"2024-09-12","cve":"CVE-2024-6387"},{"vendor":"Zscaler","title":"OpenSSH vulnerabilities CVE-2024-6387 and CVE-2024-6409","url":"https://www.zscaler.com/blogs/security-research/openssh-vulnerabilities-cve-2024-6387-cve-2024-6409-pose-significant","date":"2024-08-05","cve":"CVE-2024-6387"}],"coverage":[{"title":"OpenSSH 9.8 release notes","publisher":"OpenSSH","url":"https://www.openssh.com/txt/release-9.8","date":"2024-07-01","type":"vendor"},{"title":"Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion)","publisher":"Qualys","url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server","date":"2024-07-01","type":"research"},{"title":"Qualys technical advisory (regresshion.txt)","publisher":"Qualys","url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","date":"2024-07-01","type":"research"},{"title":"Cisco regreSSHion product advisory","publisher":"Cisco","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024","date":"2024-07-02","type":"vendor"},{"title":"Fortinet FG-IR-24-258","publisher":"Fortinet","url":"https://www.fortiguard.com/psirt/FG-IR-24-258","date":"2024-07-09","type":"vendor"}],"posts":[],"research":[{"title":"OpenSSH 9.8 release notes","url":"https://www.openssh.com/txt/release-9.8","authors":"OpenSSH","date":"2024-07-01"},{"title":"Qualys regreSSHion blog","url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server","authors":"Bharat Jogi / Qualys TRU","date":"2024-07-01"},{"title":"Qualys technical advisory","url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","authors":"Qualys","date":"2024-07-01"},{"title":"NVD CVE-2024-6387","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6387","authors":"NVD","date":"2024-07-01"},{"title":"Ubuntu CVE page","url":"https://ubuntu.com/security/CVE-2024-6387","authors":"Ubuntu","date":"2024-07-01"},{"title":"Red Hat CVE page","url":"https://access.redhat.com/security/cve/cve-2024-6387","authors":"Red Hat","date":"2024-07-01"}],"impact":{"kind":"shared-component","component":"OpenSSH sshd (Portable OpenSSH on glibc Linux)","matrixNote":"OpenBSD is not vulnerable. Many enterprise Linux releases before OpenSSH 8.5p1 are outside the regression window and vendors state not affected.","downstream":[{"product":"OpenSSH Portable","vendor":"OpenSSH Project","type":"linux-distro","status":"affected","versions":"9.8 / 9.8p1","vendorStatement":{"date":"1 Jul 2024","url":"https://www.openssh.com/txt/release-9.8","quote":"A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive). OpenBSD is not vulnerable."}},{"product":"Ubuntu 24.04 LTS (noble)","vendor":"Canonical","type":"linux-distro","status":"affected","versions":"1:9.6p1-3ubuntu13.3","vendorStatement":{"date":"1 Jul 2024","url":"https://ubuntu.com/security/CVE-2024-6387","quote":"openssh 24.04 LTS noble Fixed in 1:9.6p1-3ubuntu13.3."}},{"product":"Ubuntu 22.04 LTS (jammy)","vendor":"Canonical","type":"linux-distro","status":"affected","versions":"1:8.9p1-3ubuntu0.10","vendorStatement":{"date":"1 Jul 2024","url":"https://ubuntu.com/security/CVE-2024-6387","quote":"openssh 22.04 LTS jammy Fixed in 1:8.9p1-3ubuntu0.10."}},{"product":"Ubuntu 20.04 LTS (focal)","vendor":"Canonical","type":"linux-distro","status":"vendor-stated-not-affected","vendorStatement":{"date":"1 Jul 2024","url":"https://ubuntu.com/security/CVE-2024-6387","quote":"openssh 20.04 LTS focal Not affected."}},{"product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","type":"linux-distro","status":"affected","versions":"RHSA-2024:4312 (openssh-0:8.7p1-38.el9_4.1)","vendorStatement":{"date":"1 Jul 2024","url":"https://access.redhat.com/security/cve/cve-2024-6387","quote":"Red Hat Enterprise Linux 9 fixed via RHSA-2024:4312 on 2024-07-03."}},{"product":"Red Hat Enterprise Linux 8 / 7 / 6","vendor":"Red Hat","type":"linux-distro","status":"vendor-stated-not-affected","vendorStatement":{"date":"1 Jul 2024","url":"https://access.redhat.com/security/cve/cve-2024-6387","quote":"Red Hat Enterprise Linux 8, 7, and 6 package_state Not affected for openssh."}},{"product":"Amazon Linux 2023","vendor":"Amazon","type":"linux-distro","status":"affected","versions":"ALAS2023-2024-649","vendorStatement":{"date":"1 Jul 2024","url":"https://explore.alas.aws.amazon.com/CVE-2024-6387.html","quote":"Amazon Linux 2023 openssh Fixed, advisory ALAS2023-2024-649, release date 2024-07-01."}},{"product":"Amazon Linux 1 / 2","vendor":"Amazon","type":"linux-distro","status":"vendor-stated-not-affected","vendorStatement":{"date":"1 Jul 2024","url":"https://explore.alas.aws.amazon.com/CVE-2024-6387.html","quote":"Amazon Linux 1 and Amazon Linux 2 openssh Not Affected. AL1 and AL2 comes with OpenSSH version 7.4p1."}},{"product":"SUSE Linux Enterprise Server 15 SP6","vendor":"SUSE","type":"linux-distro","status":"affected","versions":"openssh >= 9.6p1-150600.6.3.1","vendorStatement":{"date":"Checked 23 Oct 2026","url":"https://www.suse.com/security/cve/CVE-2024-6387.html","quote":"SUSE Linux Enterprise Server 15 SP6 lists openssh >= 9.6p1-150600.6.3.1. SUSE states SLES 11 up to 15 SP5 are not affected."}},{"product":"FortiOS","vendor":"Fortinet","type":"network-security","status":"vendor-stated-not-affected","vendorStatement":{"date":"9 Jul 2024","url":"https://www.fortiguard.com/psirt/FG-IR-24-258","quote":"Products NOT Impacted: FortiOS, FortiProxy, FortiSASE, FortiClient EMS."}},{"product":"Cisco ASA Software","vendor":"Cisco","type":"network-security","status":"affected","versions":"9.18.4.34 / 9.20.3","vendorStatement":{"date":"2 Jul 2024","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024","quote":"Adaptive Security Appliance (ASA) Software CSCwk62296 fixed releases 9.18.4.34 and 9.20.3."}}]},"pocs":[],"pocEmptyState":"Qualys states it developed a working exploit and demonstrated it to the OpenSSH team, and that it does not release the exploit. No public PoC repository is indexed here.","_feed":{"page":"https://vuln2shell.com/vulns/regresshion","json":"https://vuln2shell.com/vulns/regresshion.json","iocsCsv":"https://vuln2shell.com/vulns/regresshion/iocs.csv","stix":"https://vuln2shell.com/vulns/regresshion/stix.json"}}