Regresshion vulnerability: Recommended actions and steps we've taken

DigitalOcean is aware of a new security issue with OpenSSH (sshd) that was released yesterday under the title “regresshion” or CVE-2024-6387. This vulnerability appears to allow an attacker to gain remote root access on vulnerable Linux systems running OpenSSH. However, there are some important caveats. Notably, the exploit requires winning a race condition which can take several hours.

We are asking our customers to upgrade SSHD on their Droplets. If customers are running their own SSHD servers as part of a containerized workload (e.g., SSHD inside a Kubernetes pod) you should upgrade that service and relaunch the workload. Instructions can be found below for how to update SSHD on Dropets.

The table below lists the Security Notices published for each DigitalOcean provided distribution:

As part of our shared responsibility model, we are taking several actions in response to this vulnerability, which are outlined below.

DigitalOcean Products

Additionally, DigitalOcean is taking action to ensure the version of OpenSSH used across its internal environment is patched.

Action for Droplets

Customer managed Droplets

Ubuntu and Debian

Interactive commands:

sudo apt update
sudo apt install --only-upgrade openssh-server openssh-client

Non-interactive commands:

sudo apt update
sudo env DEBIAN_FRONTEND=noninteractive apt install --only-upgrade -y openssh-server openssh-client

Note:

1. This command will only update OpenSSH server, client, and sftp.

2. The interactive commands will require user input on how to handle the sshd_config (keep old, compare old to new, install new, etc.).

3. The non-interactive commands will install the update and keep the existing sshd_config.

4. The --only-upgrade flag will only install the package if the package has been previously installed. This is a safety check.

It is always a good idea to update your entire system but please be aware that this may introduce potential breaking issues.

CentOS, Fedora, Rocky Linux, AlmaLinux

sudo yum update openssh-server
sudo yum update openssh-clients