Details
-
Fix
-
Status: Released (View Workflow)
-
Minor
-
Resolution: Fixed
-
2.5.7, 2.6.4
-
None
-
CVE-2023-48795
Description
Current Situation
Currently the JITL Jobs use sshj 0.37.0, which is affected by a vulnerability issue in the SSH Binary Packet Protocol (BPP).
A vulnerability affects this library: https://nvd.nist.gov/vuln/detail/CVE-2023-48795
Desired Behavior
We rate the issue as low, because components like sshj may be affected, but the problem lies not in the used component, but in the underlying protocol.
Workaround
Customers who may think they are affected can work around the issue with updating the OpenSSH Server used in their environment to a version newer than 9.6.