FreeBSD Releases Urgent Patch for High-Severity OpenSSH Vulnerability
Security fixes have been made available by the FreeBSD Project maintainers to fix a high-severity vulnerability in OpenSSH that might allow attackers to remotely execute arbitrary code with elevated privileges.
The vulnerability, identified as CVE-2024-7589, has a high severity CVSS score of 7.4 out of a possible 10.0.
An advisory published last week states that a signal handler in sshd(8) may call a logging function that is not async-signal-safe.
When a client fails to authenticate within the LoginGraceTime seconds (120 by default), the signal handler is called. The sshd(8) privileged code, which is not sandboxed and runs with full root privileges, is the context in which this signal handler runs read more about FreeBSD Releases Urgent Patch for High-Severity OpenSSH Vulnerabili...