Finding the OpenSSH version on ESX when a vulnerability scan is reporting possible vulnerabilities

Products

• VMware vSphere ESXi

Issue/Introduction

During a vulnerability scan (Qualsys, Tenable, Nessus, etc.), vulnerabilities are reported with OpenSSH on ESXi. Example vulnerabilities for OpenSSH are:

• CVE-2016-20012
• CVE-2021-36368
• CVE-2020-15778

After receiving vulnerabilty reports from the scanner, checking the OpenSSH version on the ESXi host will help clarify if the host is possibly impacted when reading the public CVE documentation about the possible vulnerabilities.

Environment

VMware ESXi host 8.X
VMware ESXi host7.X

Cause

This behavior is largely due to vulnerability scanners referencing configuration files or other static files to detected hard-coded versions, while frequently overlooking the patch levels of installed packages.

Resolution

To validate the version of OpenSSH, the following command can be used:

ssh -V

The output is as follows:

OpenSSH_9.8p1, OpenSSL 3.0.15 3 Sep 2024

This shows not only the major version (9.8) but also shows any patches that have been applied (p1 in this case).

Additional Information

If you get a report for an OpenSSH vulnerability, take the following steps:

1. Validate that the version that is impacted by checking the public documentation for the CVE.
2. Run the above commands from the Resolution section against the OpenSSH version on the ESXi host.
3. If the version is at a fixed version according to the public documentation for the CVE, work with your security teams or the vulnerability scanner vendor so they can update against possible false positives.
4. If the version is at a vulnerable version, engage Broadcom support for further support.

Japanese KB: 脆弱性スキャンで脆弱性の可能性が報告されている場合に ESXi 上の openSSH バージョンを見つける方法