PowerShell / PowerShell/Win32-OpenSSH
Please confirm which versions (if any) are vulnerable to CVE-2024-6387
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 8.3k
- Forks
- 819
- PR merge metrics
- No merged PRs in 30d
Description
Request for information
CVE-2024-6387 (stylized as regreSSHion) is a Remote Unauthenticated Code Execution vulnerability in sshd in glibc-based Linux systems, discovered by Qualys.
What I want to know: Is OpenSSH for Windows vulnerable?
I don't see any changes that line up with Qualys's disclosure timeline, and the version number that I get when I do a fresh install via Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 is 8.6.0.1 (which falls within the vulnerable range, according to what I'm seeing).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Qualys advisory linked in the issue and the reported OpenSSH 8.6.0.1 installation version. Determine whether Win32-OpenSSH is affected by CVE-2024-6387 and document which versions, if any, are vulnerable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- operating-systems, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100