Aria Operations for Networks 6.14.x Showing Vulnerabilities for OpenSSH CVE-2024-6387, CVE‑2023‑51384, CVE‑2023‑51385, and CVE‑2023‑28531

Products

• VCF Operations for Networks

Issue/Introduction

• Security scanner has found an OpenSSH vulnerability on VMware Aria Operations for Networks appliances
• Aria Operations for Networks 6.14.x shows vulnerabilities for OpenSSH in the following CVEs:
  
  CVE-2024-6387
CVE‑2023‑51384
CVE‑2023‑51385
CVE‑2023‑28531

Environment

Aria Operations for Networks

Cause

Aria Operations for Networks 6.14.0 is not affected by OpenSSH CVE-2024-6387, CVE‑2023‑51384, CVE‑2023‑51385, and CVE‑2023‑28531

Resolution

To validate if OpenSSH CVE-2024-6387, CVE‑2023‑51384, CVE‑2023‑51385, and CVE‑2023‑28531 is affected on VMware Aria Operations for Networks version 6.14.x, execute following commands:

1. Open a SSH/Putty session to Aria Operations for Networks appliance.
   
   
2. Login with username support.
   
   
3. Execute following commands
   
   

   ub
   sudo dpkg -l | grep openssh

   
   Note: You should see output similar to the following:
   
   

   ubuntu@aria-networks-platform:~$ sudo dpkg -l | grep openssh
   ii  openssh-client                        1:8.9p1-3ubuntu0.10                     amd64        secure shell (SSH) client, for secure access to remote machines
   ii  openssh-server                        1:8.9p1-3ubuntu0.10                     amd64        secure shell (SSH) server, for secure access from remote machines
   ii  openssh-sftp-server                   1:8.9p1-3ubuntu0.10                     amd64        secure shell (SSH) sftp server module, for SFTP access from remote machines

   
   Note: If the OpenSSH version is 1:8.9p1-3ubuntu0.10 or higher, VMware Aria Operations for Networks is not affected by above mentioned CVE's

 

If VMware Aria Operations for Networks is not affected, create an exception on the security vulnerability scanner as this is a false-positive result.

Additional Information

See Ubuntu Security bulletin:

2024-6387

2023-51384

2023-51385

2023-28531