Official release notes or announcements from the respective distributions

Qualys Discovers Critical OpenSSH RCE Vulnerability CVE-2024-6409 in RHEL 9

Jul 9, 2024, 03:32 PM

A significant vulnerability has been discovered in OpenSSH, a widely used secure communications protocol. Researchers at the cybersecurity firm Qualys identified the flaw, which is designated as CVE-2024-6409. The vulnerability, found in RHEL 9's versions 8.7p1 and 8.8p1, and unmaintained Fedora, allows for remote code execution (RCE) via a race condition in the privileged separation (privsep) child process. This issue has sparked considerable concern within the security community, especially since active exploits have already been detected. The flaw is distinct from another recent vulnerability, CVE-2024-6387, but shares some similarities.