ALPINE-CVE-2023-51384 — Vulnetix

Try Vulnetix Request Demo

ALPINE-CVE-2023-51384 PUBLISHED CVSS 5.5 MEDIUM

In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.

Risk Scores

CVSS v3.1

5.5

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Products

Vendor	Product	Versions
Alpine:v3.16	openssh	*, 5.1_p1-r1, 5.1p1-r0
Alpine:v3.17	openssh	7.1, 7.1, 7.1
Alpine:v3.21	openssh	7.1, 9.2, 9.3
Alpine:v3.23	openssh	5.6_p1-r1, 9.5, 9.4
Alpine:v3.22	openssh	9.5, 0, 5.1_p1-r1
Alpine:v3.20	openssh	6.9_p1-r4, 9.5, 9.4
Alpine:v3.19	openssh	5.1_p1-r1, 7.4, 7.5

Timeline

Dec 18, 2023 CVE Published
Dec 3, 2025 CVE Updated
Apr 30, 2026 Distribution Patch

References

https://security.alpinelinux.org/vuln/CVE-2023-51384 advisory

Open in Interactive Console →