topic Re: OpenSSH vulnerability in Cisco ISE in Network Access Control

OpenSSH vulnerability in Cisco ISE

Arthur Martez — Thu, 09 May 2024 18:35:00 GMT

Hello! A scan were made to my Cisco ISE and shown a vulnerability in OpenSSH, the recommendations were to upgrade OpenSSH to version >9.6, do anyone knows if there is a CVE documented to this vuln? Or there is any documentation that explain to which version upgrade my ISE?

ISE Version: 3.0.0.458
Installed Patches: 5

Re: OpenSSH vulnerability in Cisco ISE

Dustin Anderson — Thu, 09 May 2024 19:37:16 GMT

CVE should be universal, so if you know the CVE you should be able to find it on cisco.com and see if it is fixed and what version/patch. Without that info there isn't much we can instruct you on. Whatever you use to scan should give you the CVE.

Re: OpenSSH vulnerability in Cisco ISE

Arthur Martez — Thu, 09 May 2024 19:54:45 GMT

Yeah, you were right, aparentelly is the CVE-2023-48795, but I only found solved bugs for other Cisco Devices, not for ISE, do you know if theres an announced patch for that CVE and for ISE?

Re: OpenSSH vulnerability in Cisco ISE

Greg Gibbs — Thu, 09 May 2024 23:16:54 GMT

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwi57761

Re: OpenSSH vulnerability in Cisco ISE

Kaleb Kwiatkowski — Fri, 24 May 2024 20:24:34 GMT

I went through the TAC process for this and I would like to save the next person some time. The mitigation configs from the bug report listed as the solution do stop OpenSSH connections but don't stop the scanner from seeing it as a vulnerability. Hope this helps!

Re: OpenSSH vulnerability in Cisco ISE

Arthur Martez — Mon, 27 May 2024 16:23:37 GMT

Thank you! It is really helpful