CVE-2023-38408: fedoraproject fedora Unquoted Search Path or Element

Modified

AliasesALPINE-CVE-2023-38408SUSE-SU-2023:2940-1SUSE-SU-2023:2945-1+20 more

Published 20-07-2023Last modified 14-10-2026

Vulnerability summary

CVE-2023-38408 is a critical (CVSS 9.8) Unquoted Search Path or Element vulnerability in fedoraproject fedora. EPSS estimates a 79.70% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 3 public exploits are recorded.

Priority

Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

79.70%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits3reference

Advisory lineage

Upstream 0 · Downstream 1 · Related 2

MGASA-2024-0010 CGA-FRMW-HJ73-JQ63 CGA-WFW4-M8R2-5Q9C

Timeline

20-07-2023
PublishedVulnerability first disclosed.
14-10-2026
Last modifiedVulnerability information updated.

Description

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

CVSS metrics

8 scores · 8 sources · 1 version

v3.19.8

EPSS trend

Probability

79.70%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 79.70% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

3 found

referenceUnverified
Exploit Reference (qualys.com)
Maturity: unknown
referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-428Unquoted Search Path or ElementThe product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse42 products

openssh-askpass-gnome&distro=SUSE Enterprise Storage 7< 8.1p1-150200.5.37.1
openssh-askpass-gnome&distro=SUSE Enterprise Storage 7.1< 8.4p1-150300.3.22.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 7.9p1-150100.6.31.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 8.1p1-150200.5.37.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 8.4p1-150300.3.22.1

openssh-askpass-gnome&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 8.4p1-150300.3.22.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP4< 8.4p1-150300.3.22.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP5< 8.4p1-150300.3.22.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Real Time 15 SP3< 8.4p1-150300.3.22.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 7.2p2-74.63.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server 12 SP5< 7.2p2-81.4.2
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 7.9p1-150100.6.31.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server 15 SP2-LTSS< 8.1p1-150200.5.37.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server 15 SP3-LTSS< 8.4p1-150300.3.22.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 7.2p2-81.4.2
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 7.9p1-150100.6.31.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP2< 8.1p1-150200.5.37.1
openssh-askpass-gnome&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3< 8.4p1-150300.3.22.1
openssh&distro=SUSE Enterprise Storage 7< 8.1p1-150200.5.37.1
openssh&distro=SUSE Enterprise Storage 7.1< 8.4p1-150300.3.22.1
openssh&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 7.9p1-150100.6.31.1
openssh&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 8.1p1-150200.5.37.1
openssh&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 8.4p1-150300.3.22.1
openssh&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 8.4p1-150300.3.22.1
openssh&distro=SUSE Linux Enterprise Micro 5.1< 8.4p1-150300.3.22.1
openssh&distro=SUSE Linux Enterprise Micro 5.2< 8.4p1-150300.3.22.1
openssh&distro=SUSE Linux Enterprise Micro 5.3< 8.4p1-150300.3.22.1
openssh&distro=SUSE Linux Enterprise Micro 5.4< 8.4p1-150300.3.22.1
openssh&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 8.4p1-150300.3.22.1
openssh&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5< 8.4p1-150300.3.22.1
openssh&distro=SUSE Linux Enterprise Real Time 15 SP3< 8.4p1-150300.3.22.1
openssh&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 7.2p2-74.63.1
openssh&distro=SUSE Linux Enterprise Server 12 SP5< 7.2p2-81.4.2
openssh&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 7.9p1-150100.6.31.1
openssh&distro=SUSE Linux Enterprise Server 15 SP2-LTSS< 8.1p1-150200.5.37.1
openssh&distro=SUSE Linux Enterprise Server 15 SP3-LTSS< 8.4p1-150300.3.22.1
openssh&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 7.2p2-81.4.2
openssh&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 7.9p1-150100.6.31.1
openssh&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP2< 8.1p1-150200.5.37.1
openssh&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3< 8.4p1-150300.3.22.1
openssh&distro=SUSE Manager Proxy 4.2< 8.4p1-150300.3.22.1
openssh&distro=SUSE Manager Server 4.2< 8.4p1-150300.3.22.1

Show all 42

Redhat19 products

openssh< 0:8.7p1-11.el9_0 | < 0:8.0p1-7.el8_4 | < 0:7.4p1-23.el7_9 | < 0:8.0p1-5.el8_1.1 | < 0:8.0p1-5.el8_2 | < 0:8.7p1-30.el9_2 | < 0:8.0p1-15.el8_6 | < 0:8.0p1-19.el8_8 | < 0:5.3p1-125.el6_10
openssh-askpass< 0:8.7p1-11.el9_0 | < 0:8.0p1-7.el8_4 | < 0:7.4p1-23.el7_9 | < 0:8.0p1-5.el8_1.1 | < 0:8.0p1-5.el8_2 | < 0:8.7p1-30.el9_2 | < 0:8.0p1-15.el8_6 | < 0:8.0p1-19.el8_8 | < 0:5.3p1-125.el6_10
openssh-askpass-debuginfo< 0:8.7p1-11.el9_0 | < 0:8.0p1-7.el8_4 | < 0:8.0p1-5.el8_1.1 | < 0:8.0p1-5.el8_2 | < 0:8.7p1-30.el9_2 | < 0:8.0p1-15.el8_6 | < 0:8.0p1-19.el8_8
openssh-cavs< 0:8.0p1-7.el8_4 | < 0:7.4p1-23.el7_9 | < 0:8.0p1-5.el8_1.1 | < 0:8.0p1-5.el8_2 | < 0:8.0p1-15.el8_6 | < 0:8.0p1-19.el8_8
openssh-cavs-debuginfo< 0:8.0p1-7.el8_4 | < 0:8.0p1-5.el8_1.1 | < 0:8.0p1-5.el8_2 | < 0:8.0p1-15.el8_6 | < 0:8.0p1-19.el8_8

openssh-clients< 0:8.7p1-11.el9_0 | < 0:8.0p1-7.el8_4 | < 0:7.4p1-23.el7_9 | < 0:8.0p1-5.el8_1.1 | < 0:8.0p1-5.el8_2 | < 0:8.7p1-30.el9_2 | < 0:8.0p1-15.el8_6 | < 0:8.0p1-19.el8_8 | < 0:5.3p1-125.el6_10
openssh-clients-debuginfo< 0:8.7p1-11.el9_0 | < 0:8.0p1-7.el8_4 | < 0:8.0p1-5.el8_1.1 | < 0:8.0p1-5.el8_2 | < 0:8.7p1-30.el9_2 | < 0:8.0p1-15.el8_6 | < 0:8.0p1-19.el8_8
openssh-debuginfo< 0:8.7p1-11.el9_0 | < 0:8.0p1-7.el8_4 | < 0:7.4p1-23.el7_9 | < 0:8.0p1-5.el8_1.1 | < 0:8.0p1-5.el8_2 | < 0:8.7p1-30.el9_2 | < 0:8.0p1-15.el8_6 | < 0:8.0p1-19.el8_8 | < 0:5.3p1-125.el6_10
openssh-debugsource< 0:8.7p1-11.el9_0 | < 0:8.0p1-7.el8_4 | < 0:8.0p1-5.el8_1.1 | < 0:8.0p1-5.el8_2 | < 0:8.7p1-30.el9_2 | < 0:8.0p1-15.el8_6 | < 0:8.0p1-19.el8_8
openssh-keycat< 0:8.7p1-11.el9_0 | < 0:8.0p1-7.el8_4 | < 0:7.4p1-23.el7_9 | < 0:8.0p1-5.el8_1.1 | < 0:8.0p1-5.el8_2 | < 0:8.7p1-30.el9_2 | < 0:8.0p1-15.el8_6 | < 0:8.0p1-19.el8_8
openssh-keycat-debuginfo< 0:8.7p1-11.el9_0 | < 0:8.0p1-7.el8_4 | < 0:8.0p1-5.el8_1.1 | < 0:8.0p1-5.el8_2 | < 0:8.7p1-30.el9_2 | < 0:8.0p1-15.el8_6 | < 0:8.0p1-19.el8_8
openssh-ldap< 0:8.0p1-7.el8_4 | < 0:7.4p1-23.el7_9 | < 0:8.0p1-5.el8_1.1 | < 0:8.0p1-5.el8_2 | < 0:8.0p1-15.el8_6 | < 0:8.0p1-19.el8_8 | < 0:5.3p1-125.el6_10
openssh-ldap-debuginfo< 0:8.0p1-7.el8_4 | < 0:8.0p1-5.el8_1.1 | < 0:8.0p1-5.el8_2 | < 0:8.0p1-15.el8_6 | < 0:8.0p1-19.el8_8
openssh-server< 0:8.7p1-11.el9_0 | < 0:8.0p1-7.el8_4 | < 0:7.4p1-23.el7_9 | < 0:8.0p1-5.el8_1.1 | < 0:8.0p1-5.el8_2 | < 0:8.7p1-30.el9_2 | < 0:8.0p1-15.el8_6 | < 0:8.0p1-19.el8_8 | < 0:5.3p1-125.el6_10
openssh-server-debuginfo< 0:8.7p1-11.el9_0 | < 0:8.0p1-7.el8_4 | < 0:8.0p1-5.el8_1.1 | < 0:8.0p1-5.el8_2 | < 0:8.7p1-30.el9_2 | < 0:8.0p1-15.el8_6 | < 0:8.0p1-19.el8_8
openssh-server-sysvinit< 0:7.4p1-23.el7_9
openssh-sk-dummy-debuginfo< 0:8.7p1-30.el9_2
pam_ssh_agent_auth< 0:0.10.4-4.11.el9_0 | < 0:0.10.3-7.7.el8_4.1 | < 0:0.10.3-2.23.el7_9 | < 0:0.10.3-7.5.el8_1 | < 0:0.10.3-7.5.el8_2 | < 0:0.10.4-5.30.el9_2 | < 0:0.10.3-7.15.el8_6 | < 0:0.10.3-7.19.el8_8 | < 0:0.9.3-125.el6_10
pam_ssh_agent_auth-debuginfo< 0:0.10.4-4.11.el9_0 | < 0:0.10.3-7.7.el8_4.1 | < 0:0.10.3-7.5.el8_1 | < 0:0.10.3-7.5.el8_2 | < 0:0.10.4-5.30.el9_2 | < 0:0.10.3-7.15.el8_6 | < 0:0.10.3-7.19.el8_8

Show all 19

Opensuse6 products

openssh-askpass-gnome&distro=openSUSE Leap 15.4< 8.4p1-150300.3.22.1
openssh-askpass-gnome&distro=openSUSE Leap 15.5< 8.4p1-150300.3.22.1
openssh&distro=openSUSE Leap 15.4< 8.4p1-150300.3.22.1
openssh&distro=openSUSE Leap 15.5< 8.4p1-150300.3.22.1
openssh&distro=openSUSE Leap Micro 5.3< 8.4p1-150300.3.22.1

Show all 6

Ubuntu2 products

openssh< 1:6.6p1-2ubuntu2.13+esm1 | < 1:7.2p2-4ubuntu2.10+esm3 | < 1:7.2p2-4ubuntu2.fips.2.10.4 | All versions (No fix recorded) | < 1:7.6p1-4ubuntu0.7+esm1 | < 1:7.9p1-10~ubuntu18.04.fips.0.8 | < 1:8.2p1-4ubuntu0.8 | < 1:8.2p1-4ubuntu0.fips.0.8 | < 1:8.9p1-3ubuntu0.3
openssh-ssh1All versions (No fix recorded)

Alpine1 product

openssh< 9.0_p1-r4 | < 9.1_p1-r4

Chainguard1 product

openssh< 9.3_p2-r0

Debian1 product

openssh< 1:7.9p1-10+deb10u3 | < 1:9.2p1-2+deb12u1 | < 1:9.3p2-1

Fedoraproject1 product

fedoraEOL37 | 38

Openbsd1 product

openssh< 9.3 | 9.3 | 9.3:p1

Wolfi1 product

openssh< 9.3_p2-r0

10 vendors · 75 products

References

61 links

news.ycombinator.com/item?id=36790196WEBIssue TrackingPatch
blog.qualys.com/vulnerabilities-threat-research/…ARTICLEThird Party Advisory
www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txtARTICLEWEBExploitThird Party Advisory
github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7caFIXPatch
github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8FIXPatch
github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351dFIXPatch
www.openssh.com/txt/release-9.3p2REPORTWEBRelease Notes
www.openssh.com/security.htmlREPORTWEBVendor Advisory
security.gentoo.org/glsa/202307-01Vendor AdvisoryAdvisoryThird Party Advisory
www.openwall.com/lists/oss-security/2023/07/20/1Mailing ListARTICLEExploitThird Party Advisory

Show all 61 references

www.openwall.com/lists/oss-security/2023/07/20/2Mailing ListARTICLEThird Party Advisory
packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.htmlWEBExploitThird Party AdvisoryVDB Entry
lists.fedoraproject.org/archives/…Vendor AdvisoryAdvisory
lists.fedoraproject.org/archives/…Vendor AdvisoryAdvisory
security.netapp.com/advisory/ntap-20230803-0010/Advisory
lists.debian.org/debian-lts-announce/2023/08/msg00021.htmlMailing ListARTICLE
www.openwall.com/lists/oss-security/2023/09/22/9Mailing ListARTICLE
www.openwall.com/lists/oss-security/2023/09/22/11Mailing ListARTICLE
support.apple.com/kb/HT213940WEB
www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408WEB
security.alpinelinux.org/vuln/CVE-2023-38408Advisory
www.suse.com/support/update/announcement/2023/suse-su-20232940-1/Advisory
bugzilla.suse.com/1213504REPORT
www.suse.com/security/cve/CVE-2023-38408WEB
www.suse.com/support/update/announcement/2023/suse-su-20232945-1/Advisory
bugzilla.suse.com/1186673REPORT
bugzilla.suse.com/1209536REPORT
bugzilla.suse.com/1213004REPORT
bugzilla.suse.com/1213008REPORT
www.suse.com/support/update/announcement/2023/suse-su-20232946-1/Advisory
www.suse.com/support/update/announcement/2023/suse-su-20232947-1/Advisory
www.suse.com/support/update/announcement/2023/suse-su-20232950-1/Advisory
access.redhat.com/errata/RHSA-2023:4329Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2224173REPORT
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4329.jsonAdvisory
access.redhat.com/security/cve/CVE-2023-38408REPORT
www.cve.org/CVERecord?id=CVE-2023-38408AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2023-38408AdvisoryOval
access.redhat.com/errata/RHSA-2023:4381Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4381.jsonAdvisory
access.redhat.com/errata/RHSA-2023:4382Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4382.jsonAdvisory
access.redhat.com/errata/RHSA-2023:4383Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4383.jsonAdvisory
access.redhat.com/errata/RHSA-2023:4384Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4384.jsonAdvisory
access.redhat.com/errata/RHSA-2023:4412Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4412.jsonAdvisory
access.redhat.com/errata/RHSA-2023:4413Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4413.jsonAdvisory
access.redhat.com/errata/RHSA-2023:4419Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4419.jsonAdvisory
access.redhat.com/errata/RHSA-2023:4428Advisory
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4428.jsonAdvisory
ubuntu.com/security/CVE-2023-38408REPORT
ubuntu.com/security/notices/USN-6242-1Advisory
ubuntu.com/security/notices/USN-6242-2Advisory
security-tracker.debian.org/tracker/CVE-2023-38408Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38408.jsonAdvisory
cert-portal.siemens.com/productcert/html/ssa-398330.html