CVE-2024-6387 - log back

CVE-2024-6387 edited at 01 Jul 2024 17:15:25
References
https://www.openwall.com/lists/oss-security/2024/07/01/3
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
+ https://github.com/openssh/openssh-portable/commit/81c1099d22b81ebfd20a334ce986c4f753b0db29
CVE-2024-6387 edited at 01 Jul 2024 17:12:00
Type
- Arbitrary code execution
+ Authentication bypass
CVE-2024-6387 edited at 01 Jul 2024 17:05:24
Severity
- Unknown
+ High
Remote
- Unknown
+ Remote
Type
- Unknown
+ Arbitrary code execution
Description
+ A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().
References
+ https://www.openwall.com/lists/oss-security/2024/07/01/3
+ https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
Notes
CVE-2024-6387 created at 01 Jul 2024 17:03:05