-
Título
On the impact of CVE-2024-6387, OpenSSH "regreSSHion" vulnerability -
Descrição
Safeguard for Privileged Sessions versions, 7.4.0 and 7.5.0 are affected by the recent OpenSSH remote code execution (RCE) vulnerability, which is being tracked as CVE-2024-6387, also referred to as "regreSSHion".
Long Term Support (LTS) Safeguard for Privileged Sessions releases are not affected by this CVE.
More information about this vulnerability can be found at:
https://nvd.nist.gov/vuln/detail/CVE-2024-6387 -
Causa
This is an industry-wide vulnerability and is not specific to One Identity Safeguard for Privileged Sessions.
-
Resolução
Resolution
Mitigate the attack surface by disabling local SSH access on the Web UI at:
Basic Settings -> Local Settings -> SSH Server
Please uncheck the "Enable" checkbox and Commit the change.
The SSH Server feature is intended for maintenance and debugging purposes. Please validate the change before proceeding.This vulnerability will be fixed in version 7.5.1 and 8.0.0.