On July 1, 2024, a critical signal handler race condition vulnerability was disclosed in OpenSSH servers (sshd) on glibc-based Linux systems. This vulnerability, called RegreSSHion and tracked as CVE-2024-6387, can result in unauthenticated remote code execution (RCE) with root privileges. This vulnerability has been rated High severity (CVSS 8.1).
For systems that are operated directly by you, it is crucial that you also take the necessary measures to protect these systems. In a matter of urgency, we would like to inform you, that you have to do the following steps:
1. Identify affected systems: check which of your systems are potentially affected by CVE-2024-6387.
2. Apply the necessary patches: Ensure that all affected systems are patched with the appropriate security updates.
This vulnerability impacts the following OpenSSH server versions:
