# Is CVE‑2024‑6387 fixed/backported in Rocky Linux 9.7’s OpenSSH package? **URL:** \ **Category:** Rocky Linux Help & Support\ **Tags:** rocky-linux-9\ **Created:** [February 17, 2026, 6:56pm UTC](https://forums.rockylinux.org/t/is-cve-2024-6387-fixed-backported-in-rocky-linux-9-7-s-openssh-package/20213 "2026-02-17T18:56:33Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![aplha02](https://avatars.discourse-cdn.com/v4/letter/a/e5b9ba/32.png) [@aplha02](https://forums.rockylinux.org/u/aplha02)\ **Post date:** [February 17, 2026, 6:56pm UTC](https://forums.rockylinux.org/t/is-cve-2024-6387-fixed-backported-in-rocky-linux-9-7-s-openssh-package/20213/1 "2026-02-17T18:56:34Z")
Hello, I would like to know whether the CVE-2024-6387 vulnerability in OpenSSH has been backported/fixed in the OpenSSH package for Rocky Linux 9.7. If it hasn’t, are there any alternative repositories that provide the source RPM or patch so we can build it ourselves? Thanks ---
**Author:** ![FrankCox](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/frankcox/32/1572_2.png) [@FrankCox](https://forums.rockylinux.org/u/FrankCox)\ **Post date:** [February 17, 2026, 7:12pm UTC](https://forums.rockylinux.org/t/is-cve-2024-6387-fixed-backported-in-rocky-linux-9-7-s-openssh-package/20213/2 "2026-02-17T19:12:04Z")
You can easily check this for yourself: rpm -q –changelog openssh | grep 2024-6387 As you can see, it’s listed there as fixed. ---
**Author:** ![aplha02](https://avatars.discourse-cdn.com/v4/letter/a/e5b9ba/32.png) [@aplha02](https://forums.rockylinux.org/u/aplha02)\ **Post date:** [February 17, 2026, 7:32pm UTC](https://forums.rockylinux.org/t/is-cve-2024-6387-fixed-backported-in-rocky-linux-9-7-s-openssh-package/20213/3 "2026-02-17T19:32:24Z")
Although the CVE-2024-6387 fix is listed in the changelog for the previous version (`openssh-8.7p1-45.el9.rocky.0.1.x86_64`), the vulnerability still appears to be present. ---
**Author:** ![Ritov](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@Ritov](https://forums.rockylinux.org/u/Ritov)\ **Post date:** [February 17, 2026, 8:09pm UTC](https://forums.rockylinux.org/t/is-cve-2024-6387-fixed-backported-in-rocky-linux-9-7-s-openssh-package/20213/4 "2026-02-17T20:09:15Z")
Can you elaborate on this in more detail? ---
**Author:** ![iwalker](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/iwalker/32/2599_2.png) [@iwalker](https://forums.rockylinux.org/u/iwalker)\ **Post date:** [February 17, 2026, 8:35pm UTC](https://forums.rockylinux.org/t/is-cve-2024-6387-fixed-backported-in-rocky-linux-9-7-s-openssh-package/20213/5 "2026-02-17T20:35:04Z")
> [@aplha02](#): > > the vulnerability still appears to be present. Most likely the vulnerability scanner you are using is reporting incorrect information by just looking at the version number without actually checking it correctly. If the changelog is there for the fix, then the fix is there. It’s that simple. ---
**Author:** ![aplha02](https://avatars.discourse-cdn.com/v4/letter/a/e5b9ba/32.png) [@aplha02](https://forums.rockylinux.org/u/aplha02)\ **Post date:** [February 17, 2026, 9:04pm UTC](https://forums.rockylinux.org/t/is-cve-2024-6387-fixed-backported-in-rocky-linux-9-7-s-openssh-package/20213/6 "2026-02-17T21:04:38Z")
I can see the change log. I will request my security team to rescan. rpm -q -changelog openssh-clients-8.7p1-47.el9\_7.rocky.0.1.x86\_64 | grep 2024-6387 - Possible remote code execution due to a race condition (CVE- **2024-6387** ) ---
**Author:** ![sspencerwire](https://avatars.discourse-cdn.com/v4/letter/s/c2a13f/32.png) [@sspencerwire](https://forums.rockylinux.org/u/sspencerwire)\ **Post date:** [February 18, 2026, 3:42pm UTC](https://forums.rockylinux.org/t/is-cve-2024-6387-fixed-backported-in-rocky-linux-9-7-s-openssh-package/20213/7 "2026-02-18T15:42:23Z")
@aplha02 I went through this with CentOS at my old $day\_job years ago. You need to specifically note to the security team that it is a backported fix. Sometimes you even need to show the command used to verify, etc. ---
**Author:** ![aplha02](https://avatars.discourse-cdn.com/v4/letter/a/e5b9ba/32.png) [@aplha02](https://forums.rockylinux.org/u/aplha02)\ **Post date:** [February 18, 2026, 5:11pm UTC](https://forums.rockylinux.org/t/is-cve-2024-6387-fixed-backported-in-rocky-linux-9-7-s-openssh-package/20213/8 "2026-02-18T17:11:17Z")
What are the commands you used to verify? I tried `rpm -q -changelog openssh-clients-8.7p1-47.el9_7.rocky.0.1.x86_64 | grep 2024-6387`. ---
**Author:** ![label](https://avatars.discourse-cdn.com/v4/letter/l/c5a1d2/32.png) [@label](https://forums.rockylinux.org/u/label)\ **Post date:** [February 18, 2026, 5:18pm UTC](https://forums.rockylinux.org/t/is-cve-2024-6387-fixed-backported-in-rocky-linux-9-7-s-openssh-package/20213/9 "2026-02-18T17:18:02Z")
```auto [nazu@router ansible]$ rpm -q openssh --changelog | grep 2024-6387 - Possible remote code execution due to a race condition (CVE-2024-6387) ``` ```auto [nazu@router ansible]$ rpm -q openssh --changelog | grep 2024-6387 -B1 -A1 * Thu Jul 04 2024 Dmitry Belyavskiy - 8.7p1-42 - Possible remote code execution due to a race condition (CVE-2024-6387) Resolves: RHEL-45348 ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\ **Post date:** [April 19, 2026, 5:18pm UTC](https://forums.rockylinux.org/t/is-cve-2024-6387-fixed-backported-in-rocky-linux-9-7-s-openssh-package/20213/10 "2026-04-19T17:18:25Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.