attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
Red Hat Enterprise Linux, Red Hat Enterprise Linux 10, and Red Hat Hardened Images
Classified as
CWE-863 (Incorrect Authorization)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Enterprise Linux
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Hardened Images
Subsystems
OT Supporting Infrastructure
Sectors
All Sectors
What to Know
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users. (NVD)
What to Do
Monitor Red Hat's web page for any future patch releases. See vendor advisory link below.