CVE-2023-28531 Netapp CVE debrief

Who should care

Administrators and users of OpenSSH 8.9-9.2, especially environments using ssh-agent, smartcard-backed keys, jump hosts, bastions, or per-hop SSH restrictions. Also review downstream appliances or distributions that ship OpenSSH or backported fixes, including the NetApp-related CPEs listed by NVD.

Technical summary

The source description states that ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. NVD’s version data narrows the affected range to 8.9 inclusive through 9.3 exclusive. The provided CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting a critical impact profile. The corpus also lists several NetApp CPEs alongside OpenSSH, so downstream product exposure should be checked rather than assuming upstream-only impact.

Defensive priority

Urgent. The published severity is Critical (9.8), the issue affects a core SSH trust boundary, and the corpus indicates no privilege or user interaction is required. Patch or upgrade as soon as possible, and do not rely on constrained-agent controls until remediation is verified.

Recommended defensive actions

• Upgrade OpenSSH to 9.3 or later on all affected systems.
• Audit hosts and appliances for OpenSSH 8.9-9.2 or downstream packages that may include backported code.
• Review any use of ssh-agent with smartcard keys and per-hop destination constraints, especially on bastions and jump hosts.
• Prioritize remediation on internet-reachable SSH infrastructure and administrative endpoints first.
• Apply vendor-specific advisories for downstream products listed in the source corpus, including NetApp-related advisories and distro notices.
• Verify patch status across Linux distributions and appliances rather than relying on package names alone.

Evidence notes

The supplied corpus names OpenSSH before 9.3 as affected and states the earliest affected version is 8.9. NVD’s CPE criteria specify OpenSSH 8.9 through 9.3 exclusive. The corpus does not provide exploit code or confirm active exploitation, and KEV is absent. Because the supplied vendor field says Netapp while the primary vulnerability description names OpenSSH, this debrief treats OpenSSH as the primary affected component and notes the NetApp CPE entries only as listed in NVD.

Official resources