CVE-2023-51384

A flaw was found in OpenSSH. When specifying destination constraints while adding PKCS#11-hosted private keys, the constraints only apply to the first key even in cases where the token returns multiple keys.

This vulnerability only applies to instances where destination constraints are defined and multiple keys are returned from a PKCS#11 token. Use of regular private keys, FIDO tokens and unconstrained keys are unaffected.

The affected functionality was added only in OpenSSH 8.9, we have earlier version in Red Hat Enterprise Linux 6, 7, 8 and 9.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.