High · published March 6, 2021
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
| Product | Versions | Fixed in |
|---|---|---|
| openbsd/openssh | ≥ 8.2, < 8.5 | 8.5 |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| netapp/cloud_backup | all versions | — |
| netapp/hci_management_node | all versions | — |
| netapp/solidfire | all versions | — |
| netapp/hci_compute_node_firmware | all versions | — |
| netapp/hci_storage_node_firmware | all versions | — |
| oracle/communications_offline_mediation_controller | all versions | — |
| oracle/zfs_storage_appliance | all versions | — |