{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH versions 8.7 et 8.8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-6409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6409"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0551",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans OpenSSH. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.",
  "title": "Vuln\u00e9rabilit\u00e9 OpenSSH dans des syst\u00e8mes d\u0027exploitation",
  "vendor_advisories": [
    {
      "published_at": "2024-07-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Debian",
      "url": "https://security-tracker.debian.org/tracker/CVE-2024-6409"
    },
    {
      "published_at": "2024-07-08",
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE",
      "url": "https://www.suse.com/security/cve/CVE-2024-6409.html"
    },
    {
      "published_at": "2024-07-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu",
      "url": "https://ubuntu.com/security/CVE-2024-6409"
    },
    {
      "published_at": "2024-07-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Red Hat",
      "url": "https://access.redhat.com/security/cve/CVE-2024-6409"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH versions 8.5p1 \u00e0 9.7p1 ant\u00e9rieures \u00e0 9.8 et 9.8p1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    },
    {
      "description": "OpenSSH versions ant\u00e9rieures \u00e0 4.4p1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-6387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6387"
    }
  ],
  "links": [
    {
      "title": "Avis de s\u00e9curit\u00e9 CERT-FR CERTFR-2024-AVI-0531 du 1 juillet 2024",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2024-AVI-0531/"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 OpenSSH du 28 juin 2024",
      "url": "https://www.openssh.com/txt/release-9.8"
    }
  ],
  "reference": "CERTFR-2024-AVI-0539",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans le composant OpenSSH utilis\u00e9 par diff\u00e9rents syst\u00e8mes d\u0027exploitation. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.",
  "title": "Vuln\u00e9rabilit\u00e9 OpenSSH dans des syst\u00e8mes d\u0027exploitation",
  "vendor_advisories": [
    {
      "published_at": "2024-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Red Hat",
      "url": "https://access.redhat.com/security/cve/cve-2024-6387"
    },
    {
      "published_at": "2024-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Debian",
      "url": "https://security-tracker.debian.org/tracker/DSA-5724-1"
    },
    {
      "published_at": "2024-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 FreeBSD",
      "url": "https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc"
    },
    {
      "published_at": "2024-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu",
      "url": "https://ubuntu.com/security/CVE-2024-6387"
    },
    {
      "published_at": "2024-07-02",
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE",
      "url": "https://www.suse.com/security/cve/CVE-2024-6387.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH versions 8.5p1 \u00e0 9.7p1 ant\u00e9rieures \u00e0 9.8 et 9.8p1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-6387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6387"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian",
      "url": "https://security-tracker.debian.org/tracker/DSA-5724-1"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Red Hat du 01 juillet 2024",
      "url": "https://access.redhat.com/security/cve/cve-2024-6387"
    }
  ],
  "reference": "CERTFR-2024-AVI-0531",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-01T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans OpenSSH. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": "2024-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 OpenSSH 9.8",
      "url": "https://www.openssh.com/txt/release-9.8"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH versions ant\u00e9rieures \u00e0 9.6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-51385",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51385"
    },
    {
      "name": "CVE-2023-48795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48795"
    },
    {
      "name": "CVE-2023-51384",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51384"
    }
  ],
  "links": [],
  "reference": "CERTFR-2023-AVI-1044",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-12-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans OpenSSH. Elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenSSH du 18 d\u00e9cembre 2023",
      "url": "https://www.openssh.com/txt/release-9.6"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH versions ant\u00e9rieures \u00e0 9.3p2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-38408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38408"
    }
  ],
  "links": [],
  "reference": "CERTFR-2023-AVI-0572",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-07-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans OpenSSH. Elle permet \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenSSH du 19 juillet 2023",
      "url": "https://www.openssh.com/txt/release-9.3p2"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH versions ant\u00e9rieures \u00e0 9.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    },
    {
      "description": "OpenSSH versions ant\u00e9rieures \u00e0 9.3p1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2023-AVI-0235",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-03-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eOpenSSH\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer un contournement de la politique de s\u00e9curit\u00e9 et un d\u00e9ni de\nservice \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenSSH du 15 mars 2023",
      "url": "https://www.openssh.com/txt/release-9.3"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH versions 8.7 \u00e0 9.1 ant\u00e9rieures \u00e0 9.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-25136",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25136"
    }
  ],
  "links": [],
  "reference": "CERTFR-2023-AVI-0089",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-02-03T00:00:00.000000"
    },
    {
      "description": "Ajout de r\u00e9f\u00e9rence CVE",
      "revision_date": "2023-02-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans OpenSSH. Elles\npermettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non\nsp\u00e9cifi\u00e9 par l\u0027\u00e9diteur et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenSSH 9.2 du 02 f\u00e9vrier 2023",
      "url": "https://www.openssh.com/txt/release-9.2"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH versions ant\u00e9rieures \u00e0 9.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2022-AVI-882",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-10-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans OpenSSH. Elles\npermettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non\nsp\u00e9cifi\u00e9 par l\u0027\u00e9diteur et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenSSH du 04 octobre 2022",
      "url": "https://www.openssh.com/txt/release-9.1"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH versions ant\u00e9rieures \u00e0 8.6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2021-AVI-281",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-04-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans OpenSSH. Elle permet \u00e0 un\nattaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenSSH du 18 avril 2021",
      "url": "https://www.openssh.com/txt/release-8.6"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH versions ant\u00e9rieures \u00e0 8.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2020-AVI-607",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-09-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans OpenSSH. Elles\npermettent \u00e0 un attaquant de provoquer un contournement de la politique\nde s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenSSH du 27 septembre 2020",
      "url": "https://www.openssh.com/txt/release-8.4"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH versions ant\u00e9rieures \u00e0 8.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2020-AVI-322",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-05-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans OpenSSH. Elles\npermettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance et\nune atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenSSH 8.3 du 27 mai 2020",
      "url": "https://www.openssh.com/txt/release-8.3"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH versions ant\u00e9rieures \u00e0 8.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2019-AVI-491",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-10-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans OpenSSH. Elles\npermettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non\nsp\u00e9cifi\u00e9 par l\u0027\u00e9diteur et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenSSH du 08 octobre 2019",
      "url": "https://www.openssh.com/txt/release-8.1"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH versions ant\u00e9rieures \u00e0 8.0 et 8.0p1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-6111",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6111"
    }
  ],
  "links": [],
  "reference": "CERTFR-2019-AVI-179",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-04-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans OpenSSH. Elle permet \u00e0 un\nattaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenSSH du 17 avril 2019",
      "url": "https://www.openssh.com/txt/release-8.0"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH toutes versions ant\u00e9rieures \u00e0 7.8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2018-15473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-15473"
    }
  ],
  "links": [],
  "reference": "CERTFR-2018-AVI-410",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2018-08-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans OpenSSH. Elles\npermettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non\nsp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenSSH du 24 ao\u00fbt 2018",
      "url": "http://www.openssh.com/txt/release-7.8"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH 4.X.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nCette vuln\u00e9rablit\u00e9 peut \u00eatre exploit\u00e9e par un utilisateur\nmalintentionn\u00e9, connect\u00e9 au serveur SSH vuln\u00e9rable, pour d\u00e9tourner\nl\u0027affichage du serveur X d\u00e9port\u00e9 d\u0027un autre utilisateur.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-1483",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-1483"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Mandriva MDKVA-2008:078 du 26 mars    2008 :",
      "url": "http://www.mandriva.com/archives/security/advisories?name=MDVSA-2008:078"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 OpenBSD 4.1, 4.2 et 4.3 du 03 avril    2008 :",
      "url": "http://www.openbsd.org/errata42.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 OpenBSD 4.1, 4.2 et 4.3 du 03 avril    2008 :",
      "url": "http://www.openbsd.org/errata43.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 OpenBSD 4.1, 4.2 et 4.3 du 03 avril    2008 :",
      "url": "http://www.openbsd.org/errata41.html"
    }
  ],
  "reference": "CERTA-2008-AVI-165",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2008-03-28T00:00:00.000000"
    },
    {
      "description": "Ajout de la r\u00e9f\u00e9rence \u00e0 OpenBSD.",
      "revision_date": "2008-04-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans OpenSSH permet \u00e0 un utilisateur malveillant de\nporter atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mandriva MDVSA-2008:078 du 26 mars 2008",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH versions ant\u00e9rieures \u00e0 4.7.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 de OpenSSH due \u00e0 une erreur dans l\u0027utilisation des\ncookies X11 permet \u00e0 une personne malintentionn\u00e9e distante d\u0027\u00e9lever ses\nprivil\u00e8ges.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2007-4752",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-4752"
    }
  ],
  "links": [
    {
      "title": "Liste des changements de OpenSSH 4.7 :",
      "url": "http://www.openssh.com/txt/release-4.7"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE-SE:2007:022 du 26 octobre 2007 :",
      "url": "http://www.novell.com/linux/security/advisories/2007_22_sr.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200711-02 du 01 novembre    2007 :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200711-02.xml"
    },
    {
      "title": "Mise \u00e0 jour de HP-UX Secure Shell :",
      "url": "http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Fedora du 15 octobre 2007 :",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00214.html"
    }
  ],
  "reference": "CERTA-2007-AVI-497",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2007-11-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Mise \u00e0 jour 4.7 de OpenSSH du 04 septembre 2007",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH 3.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    },
    {
      "description": "OpenSSH 4.x.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nCette vuln\u00e9rabilit\u00e9 n\u0027est exploitable que si le support de la version 1\ndu protocole ssh est activ\u00e9.\n\nUne vuln\u00e9rabili\u00e9 caus\u00e9e par une erreur dans le traitement des paquets\nssh ayant plusieurs block identiques permet de provoquer un d\u00e9ni de\nservice en utilisant toutes les ressources du processeur. Cette\nvuln\u00e9rabilit\u00e9 peut \u00eatre exploit\u00e9e au moyen d\u0027un paquet ssh sp\u00e9cialement\nconstuit.\n\n## Contournement provisoire\n\nV\u00e9rifier que la directive Protocol dans le fichier sshd_config est fix\u00e9e\n\u00e0 2 et non \u00e0 1.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-4924",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4924"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SCO SCOSA-2008.2 du 12 mars 2008 :",
      "url": "ftp://ftp.sco.com/pub/unixware7/714/security/p534336/p534336.txt"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA-200609-17 du 27 septembre    2006 :",
      "url": "http://Www.gentoo.org/security/en/glsa/glsa-200609-17.xml"
    },
    {
      "title": "R\u00e9f\u00e9rence CVE CVE-2006-4924 :",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4924"
    },
    {
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 OpenSSH du 16 septembre 2006 :",
      "url": "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/deattack.h.diff?r1=1.9\u0026r2=1.10\u0026sortby=date\u0026f=h"
    },
    {
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 OpenSSH du 16 septembre 2006 :",
      "url": "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/deattack.c.diff?r1=1.29\u0026r2=1.30\u0026sortby=date\u0026f=h"
    },
    {
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 OpenSSH du 16 septembre 2006 :",
      "url": "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/packet.c.diff?r1=1.143\u0026r2=1.144\u0026sortby=date\u0026f=h"
    }
  ],
  "reference": "CERTA-2006-AVI-411",
  "revisions": [
    {
      "description": "ajout de la section \u003cTT\u003eContournement provisoire\u003c/TT\u003e.",
      "revision_date": "2006-09-28T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 SCO.",
      "revision_date": "2008-03-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans OpenSSH permet \u00e0 un utilisateur distant mal\nintentionn\u00e9 de provoquer un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans OpenSSH",
  "vendor_advisories": []
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FreeBSD 5.4.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    },
    {
      "description": "FreeBSD 5.3 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 dans la mise en oeuvre du protocole SSH peut \u00eatre\nexploit\u00e9e par un individu malveillant afin de provoquer un d\u00e9ni de\nservice au moyen de connexions malicieusement r\u00e9alis\u00e9es.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 FreeBSD SA-06-09 du 01 mars 2006 :",
      "url": "ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06-09.openssh.asc"
    }
  ],
  "reference": "CERTA-2006-AVI-100",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-03-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans OpenSSH permet \u00e0 un utilisateur mal intentionn\u00e9\nde provoquer un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FreeBSD du 01 mars 2006",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH 3.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    },
    {
      "description": "OpenSSH 4.x.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 pr\u00e9sente sur OpenSSH peut \u00eatre exploit\u00e9e par un\nutilisateur mal intentionn\u00e9 pour \u00e9lever ses privil\u00e8ges sur le syst\u00e8me.\n\n## Solution\n\nAppliquer le correctif disponible sur le site de l\u0027\u00e9diteur (cf. section\ndocumentation).\n",
  "cves": [],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SA:2006:008 du 14 f\u00e9vrier    2006 :",
      "url": "http://www.novell.com/linux/security/advisories/2006_08_openssh.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 pour OpenBSD 3.7 et 3.8 du 12 f\u00e9vrier    2006 :",
      "url": "http://www.openbsd.org/errata37.html#ssh"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 pour OpenBSD 3.7 et 3.8 du 12 f\u00e9vrier    2006 :",
      "url": "http://www.openbsd.org/errata.html#ssh"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2006:0044 du 07 mars 2006    :",
      "url": "https://rhn.redhat.com/errata/RHSA-2006-0044.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200602-11 du 20 f\u00e9vrier    2006 :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200602-11.xml"
    },
    {
      "title": "Site Internet de OpenSSH :",
      "url": "http://www.openssh.com"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 IBM :",
      "url": "http://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH00688"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-255-1 du 21 f\u00e9vrier 2006 :",
      "url": "http://www.ubuntu.com/usn/usn-255-1"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SGI 20060703-01-P du 31 juillet 2006 :",
      "url": "ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc"
    }
  ],
  "reference": "CERTA-2006-AVI-067",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-02-10T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au site Internet OpenSSH et des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 OpenBSD, SUSE et Ubuntu.",
      "revision_date": "2006-02-24T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 Gentoo.",
      "revision_date": "2006-02-27T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 RedHat.",
      "revision_date": "2006-03-08T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 IBM.",
      "revision_date": "2006-06-23T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 SGI.",
      "revision_date": "2006-08-02T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 sur OpenSSH",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Mandriva",
      "url": "http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:034"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "tout syst\u00e8me utilisant OpenSSH dans une version ant\u00e9rieure \u00e0 la 3.6.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    },
    {
      "description": "tout programme utilisant les kits de d\u00e9veloppement ``SSH IPSEC Express\u0027\u0027 et ``SSH Certificate/TLS\u0027\u0027 de la soci\u00e9t\u00e9 SSH communications Security ;",
      "product": {
        "name": "Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "tout programme utilisant la biblioth\u00e8que Crypto++ ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Tout syst\u00e8me utilisant les fonctions de la biblioth\u00e8que openssl jusqu\u0027aux versions 0.9.7a et 0.9.6i (en particulier le module mod_ssl du serveur web Apache et l\u0027application Stunnel) ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDes travaux de recherche sur les impl\u00e9mentations des protocoles SSL/TLS\nont d\u00e9montr\u00e9 de nouvelles sources de vuln\u00e9rabilit\u00e9 :\n\n-   En ouvrant de tr\u00e8s nombreuses sessions avec serveur et en utilisant\n    des contenus chiffr\u00e9s habilement choisis, il est possible d\u0027obtenir\n    le chiffrement/d\u00e9chiffrement d\u0027un texte arbitraire par la cl\u00e9 priv\u00e9e\n    RSA du serveur. Cela peut alors permettre de d\u00e9chiffrer une session\n    intercept\u00e9e ou d\u0027usurper l\u0027identit\u00e9 du serveur.\n-   Moyennant une certaine proximit\u00e9, il est possible de d\u00e9terminer la\n    cl\u00e9 priv\u00e9e d\u0027un serveur en mesurant ses temps de r\u00e9ponse. La plupart\n    des impl\u00e9mentations mat\u00e9rielles et la biblioth\u00e8que NSS du navigateur\n    Mozilla ne semblent pas vuln\u00e9rables.\n\n## Solution\n\n-   Mettre \u00e0 jour les sources de la biblioth\u00e8que OpenSSL :\n\n        http://www.openssl.org/news/secadv_20030317.txt\n\n        http://www.openssl.org/news/secadv_20030319.txt\n\n-   Mettre \u00e0 jour la biblioth\u00e8que Crypt++ en version 5.1 au moins :\n\n        http://www.eskimo.com/~weidai/cryptlib.html\n\n-   Mettre \u00e0 jour les programmes/modules suivants :\n    -   Stunnel :\n\n            http://marc.theaimsgroup.com/?l=stunnel-users\u0026m=104827610907579\u0026w=2\n\n    -   mod_ssl pour serveur web Apache :\n\n            http://marc.theaimsgroup.com/?l=apache-modssl\u0026m=10480002921649\u0026w=2\n\n    -   OpenSSH :\n\n            http://www.openssh.com\n\n-   Appliquer le correctif du vendeur :\n    -   OpenBSD :\n\n            http://www.openbsd.com/errata.html\n\n    -   FreeBSD :\n\n            ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:06.openssl.asc\n\n    -   NetBSD :\n\n            ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-007.txt.asc\n\n    -   MacOSX :\n\n            http://docs.info.apple.com/article.html?artnum=120199\n\n    -   IBM \\`\\`AIX Toolbox for Linux\u0027\u0027 OpenSSL et mod_ssl :\n\n            http://www6.software.ibm.com/dl/aixtbx/aixtbx-p\n\n    -   OpenPKG :\n\n            http://www.openpkg.org/security/OpenPKG-2003.026-openssl.html\n\n    -   SCO OpenLinux :\n\n            ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-014.0.txt\n\n    -   Gentoo Linux :\n\n            http://forums.gentoo.org/viewtopic.php?t=43709\n\n    -   Trustix Secure Linux :\n\n            http://www.trustix.net/errata/misc/2003/TSL-2003-0010-openssl.asc.txt\n\n    -   Engarde Secure Linux :\n\n            http://www.linuxsecurity.com/advisories/engarde_advisory-3009.html\n",
  "cves": [],
  "links": [
    {
      "title": "``Remote Timing Attacks are Practical\u0027\u0027 par D. Brumley        et D. Boneh :",
      "url": "http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf"
    },
    {
      "title": "Attaque sur le chiffrement RSA :       ``Attacking RSA-based Sessions in SSL/TLS\u0027\u0027 par V.        Klima, O. Pokorny et T. Rosa :          \n  R\u00e9f\u00e9rence CVE CAN-2003-0131 :",
      "url": "http://eprint.iacr.org/2003/052/"
    },
    {
      "title": "``Attacking RSA-based Sessions in SSL/TLS\u0027\u0027 par V.        Klima, O. Pokorny et T. Rosa :",
      "url": "http://eprint.iacr.org/2003/052/"
    },
    {
      "title": "R\u00e9ponse de la soci\u00e9t\u00e9 SSH    Communications Security au CERT/CC :",
      "url": "http://www.kb.cert.org/vuls/id/AAMN-5KR27C"
    },
    {
      "title": "Attaque sur les temps de calcul :       ``Remote Timing Attacks are Practical\u0027\u0027 par D. Brumley        et D. Boneh :          \n  R\u00e9f\u00e9rence CVE CAN-2003-0147 :",
      "url": "http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf"
    }
  ],
  "reference": "CERTA-2003-AVI-057",
  "revisions": [
    {
      "description": "version initiale ;",
      "revision_date": "2003-03-25T00:00:00.000000"
    },
    {
      "description": "ajout des syst\u00e8mes AIX et NetBSD, des biblioth\u00e8ques de \u003cSPAN class=\"textit\"\u003eSSH Communications Security\u003c/SPAN\u003e et \u003cSPAN class=\"textit\"\u003eCrypto++\u003c/SPAN\u003e, et des produits \u003cSPAN class=\"textit\"\u003eStunnel\u003c/SPAN\u003e, \u003cSPAN class= \"textit\"\u003eOpenSSH\u003c/SPAN\u003e et \u003cSPAN class= \"textit\"\u003emod_ssl\u003c/SPAN\u003e.",
      "revision_date": "2003-04-01T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Usurpation d\u0027identit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des sessions"
    }
  ],
  "summary": "Deux failles, pr\u00e9sentes dans certaines impl\u00e9mentations des protocoles\nSSL/TLS, permettent \u00e0 un utilisateur mal intentionn\u00e9 soit de r\u00e9cup\u00e9rer\nla cl\u00e9 secr\u00e8te d\u0027un serveur, soit le secret partag\u00e9 d\u0027une session\nclient/serveur.\n",
  "title": "Failles dans des impl\u00e9mentations de SSL/TLS",
  "vendor_advisories": []
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH versions 8.5p1 \u00e0 9.7p1 ant\u00e9rieures \u00e0 9.8 et 9.8p1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "closed_at": "2024-10-07",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-6387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6387"
    }
  ],
  "initial_release_date": "2024-07-01T00:00:00",
  "last_revision_date": "2024-10-07T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian",
      "url": "https://security-tracker.debian.org/tracker/DSA-5724-1"
    },
    {
      "title": "Billet de blogue Qualys du 01 juillet 2024",
      "url": "https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server"
    },
    {
      "title": "Avis de s\u00e9curit\u00e9 CERT-FR CERTFR-2024-AVI-0531 du 1 juillet 2024",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2024-AVI-0531/"
    },
    {
      "title": "Avis de s\u00e9curit\u00e9 CERT-FR CERTFR-2024-AVI-0539 du 3 juillet 2024",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2024-AVI-0539/"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Red Hat du 01 juillet 2024",
      "url": "https://access.redhat.com/security/cve/cve-2024-6387"
    }
  ],
  "reference": "CERTFR-2024-ALE-009",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-01T00:00:00.000000"
    },
    {
      "description": "Rectification de la date de publication de l\u0027avis de s\u00e9curit\u00e9 OpenSSH.",
      "revision_date": "2024-07-10T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
      "revision_date": "2024-10-07T00:00:00.000000"
    },
    {
      "description": "Ajout d\u0027un lien vers l\u0027avis CERT-FR CERTFR-2024-AVI-0539.",
      "revision_date": "2024-07-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Le 1 juillet 2024, OpenSSH a publi\u00e9 un avis de s\u00e9curit\u00e9 concernant la vuln\u00e9rabilit\u00e9 critique CVE-2024-6387.\n\nCette vuln\u00e9rabilit\u00e9 permet \u00e0 un attaquant non authentifi\u00e9 d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance avec les privil\u00e8ges *root*.\n\nL\u0027\u00e9diteur pr\u00e9cise que les versions 8.5p1 \u00e0 9.7p1 sont vuln\u00e9rables, de mani\u00e8re confirm\u00e9e, sur des syst\u00e8mes Linux 32 bits avec la *glibc* et l\u0027*ASLR* activ\u00e9. Toutefois, il est pr\u00e9cis\u00e9 que l\u0027exploitation n\u00e9cessite entre six et huit heures de connexions continues. De plus, il sp\u00e9cule que ces attaques pourraient \u00eatre optimis\u00e9es pour \u00eatre plus rapides, \u00e0 plus forte raison lorsque l\u0027*ASLR* est d\u00e9sactiv\u00e9.\n\nL\u0027\u00e9diteur ajoute que l\u0027exploitation sur des syst\u00e8mes 64 bits ou sans *glibc* semble possible mais n\u0027a pas \u00e9t\u00e9 d\u00e9montr\u00e9e.\n\nCette vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte par des chercheurs de Qualys. Dans leur billet de blogue (cf. section Documentation), ceux-ci pr\u00e9cisent que les versions ant\u00e9rieures \u00e0 4.4p1 d\u0027OpenSSh sont \u00e9galement vuln\u00e9rables. \nDe plus, ils conseillent de v\u00e9rifier la pr\u00e9sence de tr\u00e8s nombreuses lignes \"*Timeout before authentication*\" dans les journaux pour d\u00e9tecter de potentielles tentatives d\u0027exploitations.\n\nEn date du 1 juillet 2024, certaines distributions Linux ont propos\u00e9 des correctifs pour des versions vuln\u00e9rables (cf. section Documentation).\n\nDans l\u0027attente de la disponibilit\u00e9 de correctifs, Qualys conseille de modifier la valeur de *LoginGraceTime* \u00e0 0 dans le fichier de configuration. Cette mesure de contournement permet d\u0027emp\u00eacher une ex\u00e9cution de code arbitraire \u00e0 distance, mais rend la machine vuln\u00e9rable \u00e0 un d\u00e9ni de service \u00e0 distance.",
  "title": "Vuln\u00e9rabilit\u00e9 dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": "2024-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 OpenSSH",
      "url": "https://www.openssh.com/txt/release-9.8"
    }
  ]
}