CVE-2023-38408

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 79.70%
EPSS Percentile: 99.61%
CISA KEV: Not listed

Description

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cve@mitre.org
Published: 20-Jul-2023 10:15
Last Modified: 15-Oct-2026 07:16
EPSS Date: 2026-10-18
CWE: CWE-428

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

openbsd / openssh
Version / affected range: * · before (exclusive) 9.3
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
openbsd / openssh
Version / affected range: 9.3
cpe:2.3:a:openbsd:openssh:9.3:-:*:*:*:*:*:*
openbsd / openssh
Version / affected range: 9.3
cpe:2.3:a:openbsd:openssh:9.3:p1:*:*:*:*:*:*
fedoraproject / fedora
Version / affected range: 37
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
fedoraproject / fedora
Version / affected range: 38
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

References

Last enrichment sync: 19-Oct-2026 03:55
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

an organization’s environment is set up and how the affected product is being utilized. For example, CVE-2023-38408 affecting OpenSSH was strictly a client-side vulnerability, meaning that any vulnerability findings Eight Questions for Assessing Vulnerability Remediation Challenges

CVE (2)

People (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.