There should be a netscaler update very soon: https://security-tracker.debian.org/tracker/CVE-2024-6387

We will see, might be NetScaler is not affected given it runs of BSD-variant

👀

"It's worth noting that OpenBSD systems are unaffected as they include a security mechanism that blocks the flaw." ref: https://thehackernews.com/2024/07/new-openssh-vulnerability-could-lead-to.html

That’s OpenBSD only. Don’t know the timeline of the different BSD flavors by heart, but NetScaler is based of FreeBSD. So it might still be affected. I’d prefer to have a formal answer 😉

You are right Jan - I should have dug deeper. https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc

Thanks for digging up the advisory!

Unclear if expoitable on FreeBSD: https://x.com/cperciva/status/1807703216567865471 Colin Percival = FreeBSD Release Engineering Lead

FYI https://support.citrix.com/article/CTX678072/cloud-software-group-security-advisory-for-cve20246387

good find. thanks

Let's wait with the "good find" until they've finished the investigation 🤣

😂

so this is still in progress as “products being evaluated” + the fact that the SSH version is still the same between old and newest build maybe best to wait..or?

@Patrick Markkula NetScaler is impacted per the article