topic ISE: CVE-2023-28531: Vulnerabilities in openssh 8.0p1 in Network Access Control

ISE: CVE-2023-28531: Vulnerabilities in openssh 8.0p1

jds5 — Mon, 16 Sep 2024 15:51:03 GMT

Hello,

Do you know what the exact impact of this vulnerability is on an ISE SNS-3655-K9 in version 3.3 P3?

BR,

José

Re: ISE: CVE-2023-28531: Vulnerabilities in openssh 8.0p1

Aref Alsouqi — Mon, 16 Sep 2024 16:40:12 GMT

It's a discovered vulnerability on the Linux based OS which ISE uses as well and it could cause a leakage of some sensitive information or denial of service as per this NetApp link provided by nist.gov:

CVE-2023-28531 OpenSSH Vulnerability in NetApp Products | NetApp Product Security

NVD - CVE-2023-28531 (nist.gov)

Re: ISE: CVE-2023-28531: Vulnerabilities in openssh 8.0p1

jds5 — Tue, 17 Sep 2024 07:00:01 GMT

Does version 3.4 fix this vulnerability?

Re: ISE: CVE-2023-28531: Vulnerabilities in openssh 8.0p1

jds5 — Wed, 18 Sep 2024 09:40:00 GMT

Hello,

Does someone have this information? Thank you,

BR,

Re: ISE: CVE-2023-28531: Vulnerabilities in openssh 8.0p1

Aref Alsouqi — Tue, 24 Sep 2024 09:39:50 GMT

Looking at the resolved bugs list in ISE 3.4 it does not seem to include it:

Release Notes for Cisco Identity Services Engine, Release 3.4 - Cisco

Re: ISE: CVE-2023-28531: Vulnerabilities in openssh 8.0p1

Kyle Stewart — Fri, 04 Oct 2024 14:15:42 GMT

I would be nice if this was included in P4 coming sometime this month (which fixes CVE-2024-20469).

Re: ISE: CVE-2023-28531: Vulnerabilities in openssh 8.0p1

Kyle Stewart — Mon, 07 Oct 2024 14:19:17 GMT

Look here. This doesn't affect ISE at all. Change the criteria to Not Affected and you'll see that confirmation. I'm sure this has to do with using customized versions of OpenSSH but vulnerability scanners only look at the version # (at least some of them).

https://sec.cloudapps.cisco.com/security/center/cvr?cveIdList=CVE-2023-28531#~cve