OpenSSH vulnerability alert in a security scan

When you run a security scan against your server, you may see an alert about an OpenSSH vulnerability. OpenSSH is the software behind Secure Shell (SSH), the encrypted remote access to your server. In most cases this alert is a false positive: the scanner reports a problem that is not actually present.

This page explains why that happens and how to confirm your server is patched.

Why this happens

Scanners often decide whether software is vulnerable by reading its version number and comparing it against a Common Vulnerabilities and Exposures (CVE) database. That check misses one important detail about how Linux distributions ship security fixes.

• Backported fixes. Distributions such as Debian apply security patches to the version they already ship, without changing the upstream version number. Your OpenSSH keeps the same version string but contains the fix.

• Scanner limitations. A scanner that only matches version numbers does not see the backported patch, so it assumes the version is still vulnerable.

As a result, a scan may flag OpenSSH_8.0p1 as vulnerable even though the specific CVE was already fixed in that package. A well-known example is CVE-2024-6387 (sometimes called "regreSSHion"), which distributions patched quickly through backports.

Confirm your server is patched

You can check this yourself in two steps.

1. Look up the CVE in Debian's public Security Tracker. It shows, per Debian release, whether a fix has been released and in which package version. Search for the exact CVE from your scan report, for example CVE-2024-6387.

2. Check the OpenSSH version installed on your server over SSH:

   # Installed OpenSSH packages and their versions
   dpkg -l | grep openssh
   
   # Running OpenSSH version
   ssh -V

Compare the package version from dpkg -l with the "fixed version" listed in the Security Tracker for your Debian release. If your installed version is equal to or newer than the fixed version, the vulnerability is patched, even though the upstream version number in the scan looks old.

When to act

• The Security Tracker shows the CVE as fixed and your package is at or above that version. This is the common case. No action is needed; the scanner alert is a false positive.

• The tracker shows the CVE as fixed but your package is older. Your server missed an update. Contact Support so it can be applied.

• The tracker shows the CVE as open (no fix yet). The fix is not available for your release yet. Contact Support if the finding is high severity.

For vulnerabilities that TurboStack detects on your host itself, review the Threat Center tab, which reports genuine findings with a severity you can act on. See also the Security overview.

Related

• Security overview
• Security hardening checklist
• Threat Center
• What is SSH?
• Support