Fortianalyzer Critical Vulnerability CVE-2023-28531 OpenSSH

Forum|Forum|2 years ago
April 2, 2024
6 replies
10284 views

Our tenable is detecting that our Fortianalyzer VM is using a vulnerable version of openSSH " The version of OpenSSH installed on the remote host is prior to 9.3 " and we should upgrade to a 9.3 or later.

is there any patch for that?

FortiAnalyzer

Best answer by jasonhong

FortiAnalyzer is not considered vulnerable to CVE-2023-28531 because it does not use ssh-add, nor smartcard, nor ssh-agent.

AEK

SuperUser

Which FAZ version?

AEK

Assiamour_Author

Explorer

the Faz is running on the latest version: v7.4.2-build2397

AEK

SuperUser

Can you try exploit the vulnerability?

The idea behind is, I think it is possible that the OpenSSH version on your FAZ is a modified version (by Fortinet).

AEK

jasonhongAnswer

Staff & Editor

FortiAnalyzer is not considered vulnerable to CVE-2023-28531 because it does not use ssh-add, nor smartcard, nor ssh-agent.

Assiamour_Author

Explorer

Thank you for your answer.

Sign up

Login with SSO

Login to the community

Login with SSO