# Updating OpenSSH to address CVE-2024-6387

**URL:** <https://forums.rockylinux.org/t/updating-openssh-to-address-cve-2024-6387/15639>\
**Category:** Rocky Linux Help & Support\
**Tags:** rocky-linux-9\
**Created:** [August 28, 2024, 3:16am UTC](https://forums.rockylinux.org/t/updating-openssh-to-address-cve-2024-6387/15639 "2024-08-28T03:16:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Garyzzz](https://avatars.discourse-cdn.com/v4/letter/g/ea666f/32.png) [@Garyzzz](https://forums.rockylinux.org/u/Garyzzz)\
**Post date:** [August 28, 2024, 3:16am UTC](https://forums.rockylinux.org/t/updating-openssh-to-address-cve-2024-6387/15639/1 "2024-08-28T03:16:07Z")

</div>

**Warning** The instructions mentioned in this post are no longer necessary. The “regreSSHion” vulnerability in Rocky Linux’s OpenSSH package is addressed in the default repositories. Please read the [SIG/Security Wiki](https://sig-security.rocky.page/), consider your needs, and plan accordingly before using the SIG/Security repository.

I am trying to address CVE-2024-6387 on my Linux server. It’s running following version.

Virtualization: vmware  
Operating System: Rocky Linux 9.4 (Blue Onyx)  
CPE OS Name: cpe:/o:rocky:rocky:9::baseos  
Kernel: Linux 5.14.0-427.24.1.el9\_4.x86\_64

When it comes to addressing CVE-2024-6387, I am bit lost as to what’s best approach to take

There is following OpenSSH installed

openssh-8.7p1-38.el9.x86\_64

As mentioned in here is running following commands best approach to take?

> **[Rocky Linux 9 - CVE-2024-6387: regreSSHion - Rocky Linux](https://rockylinux.org/news/2024-07-01-openssh-sigalrm-regression)**
>
> Rocky Linux is an open enterprise Operating System designed to be 100% bug-for-bug compatible with Enterprise Linux.

1. Install the SIG/Security release file

```auto
dnf install rocky-release-security

```

1. Disable SIG/Security security-common repo

```auto
dnf config-manager --disable security-common

```

1. Upgrade openssh

```auto
dnf --enablerepo=security-common update openssh\*

```

1. Confirm version `openssh-8.7p1-38.el9_4.security.0.5` is installed

```auto
rpm -q openssh

```

Or should I update OpenSSH using following command to address this CVE? I believe this will update OpenSSH to latest version in repository which is 8.7p1-38.el9\_4.4

update openssh \*

Please help as I am not used to Linux a lot

---

<div class="post-metadata">

**Author:** ![label](https://avatars.discourse-cdn.com/v4/letter/l/c5a1d2/32.png) [@label](https://forums.rockylinux.org/u/label)\
**Post date:** [August 28, 2024, 3:26am UTC](https://forums.rockylinux.org/t/updating-openssh-to-address-cve-2024-6387/15639/2 "2024-08-28T03:26:32Z")

</div>

CVE-2024-6387 was addressed in `openssh-8.7p1-38.el9_4.1`. The current version is `openssh-8.7p1-38.el9_4.4`.

Run `dnf update` to update your system to full. Running `rpm -q openssh` will tell you the version you are running after.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\
**Post date:** [October 27, 2024, 3:27am UTC](https://forums.rockylinux.org/t/updating-openssh-to-address-cve-2024-6387/15639/3 "2024-10-27T03:27:27Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.