Qualys scanner reporting OpenSSH Authentication Bypass Vulnerability

GaryBrand — Fri, 23 Feb 2024 21:39:14 GMT

Model

PA-3220

Software Version

10.2.8

Qualys scanner reporting OpenSSH Authentication Bypass Vulnerability

Customers are advised to upgrade to OpenSSH 9.6p1 or later to remediate this vulnerability.

Patch

Is this a true issue or false positive?

Re: Qualys scanner reporting OpenSSH Authentication Bypass Vulnerability

JayGolf — Tue, 27 Feb 2024 04:14:41 GMT

Hi @GaryBrand ,

Is there a CVE included with the vulnerability? With any news regarding vulnerabilities, I would recommend verifying your source as well as researching the associated CVE. Security advisories issued by vendors and researchers almost always mention at least one CVE ID.

If you take a look at OpenSSH security page there is a vulnerability reported on July 19th by the Qualys team that is assigned CVE-2023-38408.

topic Qualys scanner reporting OpenSSH Authentication Bypass Vulnerability in General Topics

Qualys scanner reporting OpenSSH Authentication Bypass Vulnerability

Re: Qualys scanner reporting OpenSSH Authentication Bypass Vulnerability