CVE ID:	CVE-2023-38408
Description:	The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.
Test IDs:	1.3.6.1.4.1.25623.1.0.884304   1.3.6.1.4.1.25623.1.1.2.2023.3057   1.3.6.1.4.1.25623.1.1.2.2023.2792   1.3.6.1.4.1.25623.1.1.4.2023.2947.1   1.3.6.1.4.1.25623.1.0.827945   1.3.6.1.4.1.25623.1.1.2.2023.2901   1.3.6.1.4.1.25623.1.1.2.2023.3102   1.3.6.1.4.1.25623.1.1.2.2023.2882   1.3.6.1.4.1.25623.1.1.12.2023.6242.1   1.3.6.1.4.1.25623.1.1.2.2023.2846   1.3.6.1.4.1.25623.1.1.4.2023.2945.1   1.3.6.1.4.1.25623.1.1.2.2023.3440   1.3.6.1.4.1.25623.1.0.833015   1.3.6.1.4.1.25623.1.1.4.2023.2946.1   1.3.6.1.4.1.25623.1.0.104869   1.3.6.1.4.1.25623.1.1.2.2023.3407   1.3.6.1.4.1.25623.1.1.2.2023.2863   1.3.6.1.4.1.25623.1.1.4.2023.2950.1   1.3.6.1.4.1.25623.1.1.2.2024.2286   1.3.6.1.4.1.25623.1.1.4.2023.2940.1   1.3.6.1.4.1.25623.1.1.2.2023.2921   1.3.6.1.4.1.25623.1.1.2.2023.3140   1.3.6.1.4.1.25623.1.1.12.2023.6242.2   1.3.6.1.4.1.25623.1.0.827966   1.3.6.1.4.1.25623.1.1.13.2023.200.02   1.3.6.1.4.1.25623.1.1.1.2.2023.3532   1.3.6.1.4.1.25623.1.1.2.2023.2940   1.3.6.1.4.1.25623.1.1.2.2023.3088   1.3.6.1.4.1.25623.1.1.2.2023.2816   1.3.6.1.4.1.25623.1.1.2.2023.3074
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2023-38408 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/ https://security.gentoo.org/glsa/202307-01 http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8 https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca https://news.ycombinator.com/item?id=36790196 https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt https://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408 https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html http://www.openwall.com/lists/oss-security/2023/07/20/1 http://www.openwall.com/lists/oss-security/2023/07/20/2 http://www.openwall.com/lists/oss-security/2023/09/22/11 http://www.openwall.com/lists/oss-security/2023/09/22/9