CVE-2024-6387: Almalinux

High severity, CVSS 8.1. EPSS: 99.5% chance of exploitation in the next 30 days.

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Affected products

• Almalinux Almalinux: version 9.0 only
• Amazon Amazon Linux: version 2023.0 only
• Apple macOS: from 12.0, before 12.7.6 (fixed in 12.7.6); from 13.0, before 13.6.8 (fixed in 13.6.8); from 14.0, before 14.6 (fixed in 14.6)
• Arista Eos: from 4.32.0, up to and including 4.32.1f
• Canonical Ubuntu Linux: version 23.10 only; version 24.04 only; version 22.04 only; version 22.10 only; version 23.04 only
• Debian Debian Linux: version 12.0 only
• Freebsd Freebsd: version 13.2 only; version 13.3 only; version 14.0 only; version 14.1 only
• Netapp 500f Firmware: affected versions not specified
• Netapp 8300 Firmware: affected versions not specified
• Netapp 8700 Firmware: affected versions not specified
• Netapp a150 Firmware: affected versions not specified
• Netapp a1k Firmware: affected versions not specified
• Netapp a220 Firmware: affected versions not specified
• Netapp a250 Firmware: affected versions not specified
• Netapp a400 Firmware: affected versions not specified
• Netapp a700s Firmware: affected versions not specified
• Netapp a70 Firmware: affected versions not specified
• Netapp a800 Firmware: affected versions not specified
• Netapp a900 Firmware: affected versions not specified
• Netapp a90 Firmware: affected versions not specified
• Netapp a9500 Firmware: affected versions not specified
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Bootstrap OS: affected versions not specified
• Netapp c190 Firmware: affected versions not specified
• Netapp c250 Firmware: affected versions not specified
• and 28 more

Published 2024-07-01. Last modified 2026-09-01.