# OpenSSL and OpenSSH vulnerabilities do they impact Rocky 9?

**URL:** <https://forums.rockylinux.org/t/openssl-and-openssh-vulnerabilities-do-they-impact-rocky-9/15338>\
**Category:** Rocky Linux Help & Support\
**Tags:** rocky-linux-9\
**Created:** [August 5, 2024, 1:01pm UTC](https://forums.rockylinux.org/t/openssl-and-openssh-vulnerabilities-do-they-impact-rocky-9/15338 "2024-08-05T13:01:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dodgy](https://avatars.discourse-cdn.com/v4/letter/d/ce73a5/32.png) [@Dodgy](https://forums.rockylinux.org/u/Dodgy)\
**Post date:** [August 5, 2024, 1:01pm UTC](https://forums.rockylinux.org/t/openssl-and-openssh-vulnerabilities-do-they-impact-rocky-9/15338/1 "2024-08-05T13:01:47Z")

</div>

Hi,

Recently moved to Rocky 9 and my vulnerability scanner is flagging up false positives due to it only looking at the banner of OpenSSH and OpenSSL and creating an alert of each vulnerability which applies to OpenSSH 8.7 and OpenSSL 3.0.7.

I have been able to identify these false positives by looking through the changelog and seeing CVE reference is resolved, but the few I have listed below are not showing within the changelog so I am wondering if they are impacting my Rocky 9 installation or if they have also been resolved.

OpenSSH:  
CVE-2023-51384

OpenSSL:  
CVE-2023-0465  
CVE-2023-4807  
CVE-2023-0464  
CVE-2023-0466

Thanks,  
D

---

<div class="post-metadata">

**Author:** ![iwalker](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/iwalker/32/2599_2.png) [@iwalker](https://forums.rockylinux.org/u/iwalker)\
**Post date:** [August 5, 2024, 1:41pm UTC](https://forums.rockylinux.org/t/openssl-and-openssh-vulnerabilities-do-they-impact-rocky-9/15338/2 "2024-08-05T13:41:56Z")

</div>

Probably because they are not relevant to RHEL9 - as seen here: [https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-RHEL9-unaffected/](https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-RHEL9-unaffected/)

The problem is your vulnerability scanner is reporting the wrong results for a system it doesn’t seem to recognise properly. I would suggest reporting the inaccuracies to the vendor of your vulnerability scanner.

---

<div class="post-metadata">

**Author:** ![anthyve](https://avatars.discourse-cdn.com/v4/letter/a/b2d939/32.png) [@anthyve](https://forums.rockylinux.org/u/anthyve)\
**Post date:** [August 5, 2024, 2:25pm UTC](https://forums.rockylinux.org/t/openssl-and-openssh-vulnerabilities-do-they-impact-rocky-9/15338/3 "2024-08-05T14:25:58Z")

</div>

Such inaccuracies will always exist due to Red Hat backporting security fixes, such that version announced by sshd doesn’t match the actual upstream state.  
For details, see [Security Backporting Practice - Red Hat Customer Portal](https://access.redhat.com/security/updates/backporting/)

One can get more accurate scans of RHEL derivatives if using e.g. OpenSCAP with OVAL, which is what most solid security scanners use. However, that requires SSH access.

---

<div class="post-metadata">

**Author:** ![Dodgy](https://avatars.discourse-cdn.com/v4/letter/d/ce73a5/32.png) [@Dodgy](https://forums.rockylinux.org/u/Dodgy)\
**Post date:** [August 12, 2024, 2:23pm UTC](https://forums.rockylinux.org/t/openssl-and-openssh-vulnerabilities-do-they-impact-rocky-9/15338/4 "2024-08-12T14:23:29Z")

</div>

Thank you both the link provided was helpful. 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\
**Post date:** [October 11, 2024, 2:23pm UTC](https://forums.rockylinux.org/t/openssl-and-openssh-vulnerabilities-do-they-impact-rocky-9/15338/5 "2024-10-11T14:23:54Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.