# OpenSSH vulnerability alert in a security scan

When you run a security scan against your server, you may see an alert about an OpenSSH
vulnerability. OpenSSH is the software behind Secure Shell (SSH), the encrypted remote access to
your server. In most cases this alert is a **false positive**: the scanner reports a problem that
is not actually present.

This page explains why that happens and how to confirm your server is patched.

## Why this happens

Scanners often decide whether software is vulnerable by reading its version number and comparing
it against a Common Vulnerabilities and Exposures (CVE) database. That check misses one important
detail about how Linux distributions ship security fixes.

- **Backported fixes.** Distributions such as Debian apply security patches to the version they
  already ship, without changing the upstream version number. Your OpenSSH keeps the same version
  string but contains the fix.
- **Scanner limitations.** A scanner that only matches version numbers does not see the
  backported patch, so it assumes the version is still vulnerable.

As a result, a scan may flag `OpenSSH_8.0p1` as vulnerable even though the specific CVE was
already fixed in that package. A well-known example is
[CVE-2024-6387](https://security-tracker.debian.org/tracker/CVE-2024-6387) (sometimes called
"regreSSHion"), which distributions patched quickly through backports.

> [!NOTE]
> TurboStack applies operating system security updates automatically, on a daily schedule, so
> backported OpenSSH fixes reach your server without any action from you.

## Confirm your server is patched

You can check this yourself in two steps.

1. Look up the CVE in Debian's public
   [Security Tracker](https://security-tracker.debian.org/tracker/). It shows, per Debian
   release, whether a fix has been released and in which package version. Search for the exact
   CVE from your scan report, for example
   [CVE-2024-6387](https://security-tracker.debian.org/tracker/CVE-2024-6387).

2. Check the OpenSSH version installed on your server over SSH:

   ```bash
   # Installed OpenSSH packages and their versions
   dpkg -l | grep openssh

   # Running OpenSSH version
   ssh -V
   ```

Compare the package version from `dpkg -l` with the "fixed version" listed in the Security
Tracker for your Debian release. If your installed version is equal to or newer than the fixed
version, the vulnerability is patched, even though the upstream version number in the scan looks
old.

## When to act

- **The Security Tracker shows the CVE as fixed and your package is at or above that version.**
  This is the common case. No action is needed; the scanner alert is a false positive.
- **The tracker shows the CVE as fixed but your package is older.** Your server missed an update.
  Contact [Support](../platform/support.md) so it can be applied.
- **The tracker shows the CVE as open (no fix yet).** The fix is not available for your release
  yet. Contact [Support](../platform/support.md) if the finding is high severity.

For vulnerabilities that TurboStack detects on your host itself, review the
[Threat Center](../platform/hosts/threat-center.md) tab, which reports genuine findings with a
severity you can act on. See also the [Security overview](../concepts/security-overview.md).

## Related

- [Security overview](../concepts/security-overview.md)
- [Security hardening checklist](../concepts/security-hardening.md)
- [Threat Center](../platform/hosts/threat-center.md)
- [What is SSH?](../technologies/ssh/what-is.md)
- [Support](../platform/support.md)