HPE Oneview & CVE-2024-6387

[rdgg]

Hi,

How 

CVE-2024-6387

fixed in HPE oneview ?

https://www.cve.org/CVERecord?id=CVE-2024-6387

--------

Assigner: Red Hat, Inc.

Published: 2024-07-01

Updated: 2024-07-04

Title: Openssh: Possible Remote Code Execution Due To A Race Condition In Signal Handling

Description

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

----------------------

[ManBha · Accepted solution]

Hello,

HPE is aware of CVE-2024-6387 (a.k.a. "regreSSHion"), a signal handling vulnerability in OpenSSH. Most HPE products are not vulnerable to this issue. However, for any affected products, security bulletins will be issued when fixes become available.

https://support.hpe.com/hpesc/public/docDisplay?docId=sd00001284en_us&page=GUID-D9A5A789-A7C0-4250-93FF-04D4FBD2E5A8.html&docLocale=en_US

Thanks.

[DanCernese]

HPE OneView does not use any of the vulnerable versions.  As posted, monitor the official security bulletin status.