# OpenSSH vulnerability CVE-2024-6387 **URL:** \ **Category:** Rocky Linux Help & Support\ **Created:** [July 1, 2024, 8:53pm UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883 "2024-07-01T20:53:46Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![sparesimian](https://avatars.discourse-cdn.com/v4/letter/s/46a35a/32.png) [@sparesimian](https://forums.rockylinux.org/u/sparesimian)\ **Post date:** [July 1, 2024, 8:53pm UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/1 "2024-07-01T20:53:46Z")
> **[New OpenSSH Vulnerability Could Lead to RCE as Root on Linux Systems](https://thehackernews.com/2024/07/new-openssh-vulnerability-could-lead-to.html?m=1)** > > Critical OpenSSH vulnerability allows remote code execution on Linux systems. Patch now to protect against potential attacks on millions of exposed se According to this Reddit thread, RHEL 6, 7, and 8 are ok, but 9 is affected. [https://www.reddit.com/r/sysadmin/comments/1dspa43/cve20246387\_pretty\_big\_openssh\_vuln\_for\_any\_glibc/](https://www.reddit.com/r/sysadmin/comments/1dspa43/cve20246387_pretty_big_openssh_vuln_for_any_glibc/) ---
**Author:** ![label](https://avatars.discourse-cdn.com/v4/letter/l/c5a1d2/32.png) [@label](https://forums.rockylinux.org/u/label)\ **Post date:** [July 1, 2024, 8:56pm UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/2 "2024-07-01T20:56:52Z")
We are aware. You have two options: - Mitigate the issue by setting LoginGraceTime to 0 (note this can lead to a DoS) - Install rocky-release-security and update openssh, as it contains a patch _until_ RHEL releases it themselves See for more information: [cve-details](https://access.redhat.com/security/cve/CVE-2024-6387) ---
**Author:** ![smith](https://avatars.discourse-cdn.com/v4/letter/s/f04885/32.png) [@smith](https://forums.rockylinux.org/u/smith)\ **Post date:** [July 2, 2024, 8:25pm UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/3 "2024-07-02T20:25:47Z")
I don’t want to be careless and ask if my train of thought is maybe wrong. We have a SSH server with two factor authentication and fail2ban. Does the later not mitigate the issue? ---
**Author:** ![sweh](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/sweh/32/1287_2.png) [@sweh](https://forums.rockylinux.org/u/sweh)\ **Post date:** [July 2, 2024, 11:36pm UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/4 "2024-07-02T23:36:24Z")
`fail2ban` will definitely help by reducing the number of attempts an attacker can make. Since this is a timing attack and it’s not (yet!) been demonstrated on a 64bit system, I would wait until RedHat patch. But that’s just me 🙂 ---
**Author:** ![iwalker](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/iwalker/32/2599_2.png) [@iwalker](https://forums.rockylinux.org/u/iwalker)\ **Post date:** [July 3, 2024, 7:36am UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/5 "2024-07-03T07:36:21Z")
Restricting SSH to only trusted IP’s will also help reduce it if not eliminate the risk completely until the patch is released by RH for the main distro openssh package. ---
**Author:** ![otheus](https://avatars.discourse-cdn.com/v4/letter/o/97f17d/32.png) [@otheus](https://forums.rockylinux.org/u/otheus)\ **Post date:** [July 3, 2024, 11:31am UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/6 "2024-07-03T11:31:25Z")
I’m fairly certain fail2ban will not help without a matching expression for connection-closed to Timeout. Logging must be set verbosely enough in order to catch that message. Fail2ban must be configured to recognize it as a failed login. ---
**Author:** ![otheus](https://avatars.discourse-cdn.com/v4/letter/o/97f17d/32.png) [@otheus](https://forums.rockylinux.org/u/otheus)\ **Post date:** [July 3, 2024, 11:34am UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/7 "2024-07-03T11:34:02Z")
2-factor does not mitigate it. I’m not certain, but it seems that fail2ban does not mitigate it, if the attack is done in a way to avoid creating a failed login before the timeout occurs. The exploit uses the timeout + log message of such, combined with bogus payloads for the authentication step. ---
**Author:** ![sweh](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/sweh/32/1287_2.png) [@sweh](https://forums.rockylinux.org/u/sweh)\ **Post date:** [July 3, 2024, 1:00pm UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/8 "2024-07-03T13:00:16Z")
Not sure if “error: kex\_exchange\_identification: Connection closed by remote host” is logged by the attack path or not; that could be something fail2ban can block on. Otherwise, yeah, just “connection closed” lines. In my case I use IPTables to rate limit ssh attempts (I’ve not yet updated my external facing machines to RL9) just to stop brute force attacks. It’d also help prevent this new attack. ```shell # SSH firewall rules - deny access to servers that make more than 5 connections # in 60 seconds IPT=/sbin/iptables # Set this to "DROP" to drop packets, or REJECT to reject packets DROP=REJECT # Only log slowly so we don't fill up logs and overload the linode $IPT -N ssh-drop $IPT -A ssh-drop -m limit --limit 2/minute -j LOG --log-prefix "FIREWALL:SSH-DROPPED " $IPT -A ssh-drop -j $DROP # Set this to "ssh-drop" for logging, or $DROP to silently lock them out DEST=ssh-drop $IPT -A INPUT -p TCP --dport 22 --syn -m recent --name ssh --update --seconds 60 --hitcount 5 -j $DEST $IPT -A INPUT -p TCP --dport 22 --syn -m recent --name ssh --set ``` ---
**Author:** ![Ritov](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@Ritov](https://forums.rockylinux.org/u/Ritov)\ **Post date:** [July 3, 2024, 4:35pm UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/9 "2024-07-03T16:35:35Z")
> [@iwalker](#): > > until the patch is released by RH for the main distro openssh package. Upstream released it now (openssh-8.7p1-38.el9\_4.1) ---
**Author:** ![sparesimian](https://avatars.discourse-cdn.com/v4/letter/s/46a35a/32.png) [@sparesimian](https://forums.rockylinux.org/u/sparesimian)\ **Post date:** [July 3, 2024, 5:04pm UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/10 "2024-07-03T17:04:41Z")
With iptables deprecated, we’d need the equivalent for firewalld or nftables. ---
**Author:** ![ed182](https://avatars.discourse-cdn.com/v4/letter/e/e8c25b/32.png) [@ed182](https://forums.rockylinux.org/u/ed182)\ **Post date:** [July 3, 2024, 11:50pm UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/11 "2024-07-03T23:50:13Z")
Wow , checking all informatio inside the world , what is happening with the OPENSSH service . anyway , is there any way to know who is going to launch first the patch … selinux , iptables does not help with the situation ? ---
**Author:** ![iwalker](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/iwalker/32/2599_2.png) [@iwalker](https://forums.rockylinux.org/u/iwalker)\ **Post date:** [July 4, 2024, 6:15am UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/12 "2024-07-04T06:15:50Z")
> [@ed182](#): > > Wow , checking all informatio inside the world , what is happening with the OPENSSH service . anyway , is there any way to know who is going to launch first the patch … You do know that Rocky is based on RHEL right? That means we have what RHEL has. When RHEL has it, then official Rocky OpenSSH will also have it. Also, if you read above you will see from security SIG repo you could have upgraded OpenSSH and you would have already had the fix - since the Rocky team patched it before RHEL even patched the official package. @label said: > [@label](#): > > - Install rocky-release-security and update openssh, as it contains a patch _until_ RHEL releases it themselves Read first before commenting. ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [July 4, 2024, 8:24am UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/13 "2024-07-04T08:24:02Z")
> [@sparesimian](#): > > With iptables deprecated, we’d need the equivalent for firewalld or nftables. The `iptables` tool in Rocky 8 and 9 is a wrapper-translator that generates nftables rules. (some exotic rules may fail to translate.) There is even a script that reads stored iptables ruleset-file and prints equivalent nftables syntax. Therefore, you should be able to create at least a start for `nftables.service`. ---
**Author:** ![sree850](https://avatars.discourse-cdn.com/v4/letter/s/ecd19e/32.png) [@sree850](https://forums.rockylinux.org/u/sree850)\ **Post date:** [July 10, 2024, 4:24am UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/14 "2024-07-10T04:24:26Z")
Is this patch is released ? or do i need to use rocky security patch ? ---
**Author:** ![label](https://avatars.discourse-cdn.com/v4/letter/l/c5a1d2/32.png) [@label](https://forums.rockylinux.org/u/label)\ **Post date:** [July 10, 2024, 6:19am UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/15 "2024-07-10T06:19:30Z")
You can `dnf update` at any time to get an updated openssh with the patch. Using the SIG/security package is not necessary. ---
**Author:** ![sree850](https://avatars.discourse-cdn.com/v4/letter/s/ecd19e/32.png) [@sree850](https://forums.rockylinux.org/u/sree850)\ **Post date:** [July 10, 2024, 10:31am UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/16 "2024-07-10T10:31:45Z")
I did this, and it shows nothing to update. But when i checked the ssh version it shows the date from november 22. ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [July 10, 2024, 11:22am UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/17 "2024-07-10T11:22:41Z")
What do you see with: `dnf list openssh\*` ---
**Author:** ![sree850](https://avatars.discourse-cdn.com/v4/letter/s/ecd19e/32.png) [@sree850](https://forums.rockylinux.org/u/sree850)\ **Post date:** [July 10, 2024, 11:27am UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/18 "2024-07-10T11:27:05Z")
> [@jlehtone](#): > > dnf list openssh\* ![image](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/2X/8/8b6dfec10083cfae27f6352c62cc4b4736087cb0.png) ---
**Author:** ![neil](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/neil/32/34_2.png) [@neil](https://forums.rockylinux.org/u/neil)\ **Post date:** [July 10, 2024, 12:14pm UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/19 "2024-07-10T12:14:16Z")
The ‘date’ in `sshd --version` is not the build date of the software–it’s the upstream release date. > **[What is backporting, and how does it apply to RHEL and other Red Hat products?](https://www.redhat.com/en/blog/what-backporting-and-how-does-it-apply-rhel-and-other-red-hat-products)** > > Version numbers are important, but aren't always what they seem at first glance. Red Hat, for example, often backports updates to the software we ship in Red Hat Enterprise Linux (RHEL) to maintain the version that we shipped. You have the latest version of openssh installed on your system. That is why it says there’s “Nothing to do”. `rpm -q --changelog openssh` shows the package build information. ---
**Author:** ![sree850](https://avatars.discourse-cdn.com/v4/letter/s/ecd19e/32.png) [@sree850](https://forums.rockylinux.org/u/sree850)\ **Post date:** [July 10, 2024, 12:21pm UTC](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883/20 "2024-07-10T12:21:30Z")
Thank for the clarification [Next page](https://forums.rockylinux.org/t/openssh-vulnerability-cve-2024-6387/14883.md?page=2)