sshd CVE-2024-6387 vulnerability

stephenw10

Theoretically. See: https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc
Workaround patch incoming.

marcg

JonathanLee

Workaround

If sshd(8) cannot be updated, this signal handler race condition can be
mitigated by setting LoginGraceTime to 0 in /etc/ssh/sshd_config and
restarting sshd(8). This makes sshd(8) vulnerable to a denial of service
(the exhaustion of all MaxStartups connections), but makes it safe from the
remote code execution presented in this advisory.

Is this the recommendation for older versions of pfSense currently?

stephenw10

Yes, the patch will set that.

slu

And the patch is already there, good work Netgate!

stephenw10

See: https://forum.netgate.com/topic/189010/netgate-security-advisory-cve-2024-6387

tedquade

@stephenw10 Will a fix for this be incorporated in the next 24.09-Development release?

Ted

stephenw10

Yes 24.08 will have an updated openssh version.

jos-andel

@stephenw10
How about the new CE 2.8.0 ? Is that alright as well ?

stephenw10

This post is deleted!

stephenw10

2.8.0 has the patched code: https://github.com/pfsense/FreeBSD-src/commit/2abea9df01655633aabbb9bf3204c90722001202