Edge SWG (formerly ProxySG) vulnerability status in respect to CVE-2023-51384 and CVE-2023-51385

Products

• ISG Proxy
• ProxySG Software - SGOS

Issue/Introduction

Proxy administrators would like to determine if Edge SWG (formerly ProxySG) devices are vulnerable to CVE-2023-51384 and CVE-2023-51385.

Environment

Edge SWG (formerly ProxySG)

Cause

Vulnerability Details

CVE ID Number: CVE-2023-51384
Component: OpenSSH
Date Published: December 16th, 2023
Description: In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.

CVE ID Number: CVE-2023-51385
Component: OpenSSH
Date Published: December 18th, 2023
Description: In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

Advisory Link(s)

• https://nvd.nist.gov/vuln/detail/CVE-2023-51384 
• https://nvd.nist.gov/vuln/detail/CVE-2023-51385 

Resolution

Edge SWG (formerly ProxySG) devices are not vulnerable to neither CVE-2023-51384 and CVE-2023-51385.