AlmaLinux OS 9 Patching for CVE-2024-6409
Quoting: AlmaLinux OS - Forever-Free Enterprise-Grade Operating System —
AlmaLinux OS 9 is impacted by a newly disclosed vulnerability in OpenSSH’s server (sshd) in glibc-based Linux systems similiar to last week’s CVE-2024-6387. The new vulnerability has been assigned the identifier CVE-2024-6409. It involves a signal handler race condition, which could expose your system to potential security risks.
At AlmaLinux, we place security first and we are committed to delivering patches to our users as quickly as possible, especially when our community needs them. The decision to build the update and push the package to production without waiting for a CentOS Stream or RHEL update was made by our newly-formed technical steering committee, ALESCo.
The OpenSSH patch for CVE-2024-6409 has been released and is available for AlmaLinux OS 9 users.
Also:
-
AlmaLinux Patches Another Security Hole That It Appeared Red Hat Was Ignoring - FOSS Force
On Tuesday, the folks at AlmaLinux announced that they’ve patched another security hole that Red Hat and CentOS Stream haven’t gotten around to patching yet.
“In fairness to Red Hat, they were just much slower than we were,” benny Vasquez, the chairperson at the AlmaLinux Foundation told me in an email. “We were ready to go on Monday, but were hesitating because we throught RHEL was going to get patched Monday night.”
Red Hat did eventually issue a patch for RHEL and CentOS Stream — on Wednesday, a day after AlmaLinux issued it’s patch.