OpenSSH vulnerabilities from April 2025 Qualys scan against PAM

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

A Qualys scan run in April 2025 came up with a list of OpenSSH vulnerabilities that may affect Broadcom Privileged Access Management:

• QID-38904
• QID-38987
• QID-38903
• QID-150863
• QID-38902
• QID-38900

Environment

Qualys Vulnerability Scanner run for Broadcom Privileged Access Manager

Cause

The report was generated by the Qualys scanner against PAM, using the State of "Confirmed Vulnerabilities" and "Potential Vulnerabilities":

 

Resolution

PAM in fact is not vulnerable to the listed QIDs. We recommend to repeat a scan with just the "Confirmed Vulnerabilities" boxes checked.

 

Here is a detailed response to the provided list:

• Vulnerability: QID-38904: 3 - Medium - OpenSSH Remote Code Execution (RCE) Vulnerability in its forwarded ssh-agent

This vulnerability (CVE-2023-38408) is a condition where specific libraries loaded via ssh-agent(1)'s PKCS#11 support could be abused to achieve remote code execution via a forwarded agent socket if the conditions mentioned here are met.

Response: This is a vulnerability in ssh-agent. PAM does not enable ssh-agent.

 

• Vulnerability: QID-38987: 3 - Medium - OpenSSH User Enumeration Vulnerability (CVE-2018-15473)

Response: There is only one user who can login to PAM instance. It does not impact PAM.
 

• Vulnerability: QID-38903: 3 - Medium - OpenSSH Probable User Enumeration Vulnerability

CVE-2016-20012: OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session.

Response: There is only one user in PAM that can login with public key. That is the default user root.

 

• Vulnerability: QID-150863: 3 - Medium - Apache Hypertext Transfer Protocol Server (HTTP Server) Multiple Security Vulnerabilities (CVE-2023-38709, CVE-2024-24795)

Response: CVE-2023-38709, CVE-2024-24795: These vulnerabilities in Apache HTTP server. These can be exploited by having a malicious or compromised backend application which injects a new line in the http response headers to split the response into parts. These vulnerabilities does not apply to PAM as the PAM backend application is

within the PAM instance and Apache HTTP server inside pam does not forward requests any application outside of PAM instance.

 

• Vulnerability: QID-38902: 3 - Medium - OpenSSH Man-in-the-Middle (MITM) Attack Vulnerability

CVE-2020-14145:The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).

NOTE: some reports state that 8.5 and 8.6 are also affected.

Response: This is a vulnerability in the OpenSSH Client, not on the server, so it does not impact PAM.

 

• Vulnerability: QID-38900: 3 - Medium - OpenSSH Public-Key Authentication Vulnerability

CVE-2021-36368: If a client is using public-key authentication with agent forwarding but without -o LogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf.

Response: This is a vulnerability in OpenSSH Client. Exploitation of this vulnerability needs a the server to have None authentication scheme set which is not the case with PAM.  This does not affect PAM.