{"api_version":"1","generated_at":"2026-07-23T06:08:01+00:00","cve":"CVE-2008-3844","urls":{"html":"https://cve.report/CVE-2008-3844","api":"https://cve.report/api/cve/CVE-2008-3844.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-3844","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-3844"},"summary":{"title":"CVE-2008-3844","description":"Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain an externally introduced modification (Trojan Horse) that allows the package authors to have an unknown impact.  NOTE: since the malicious packages were not distributed from any official Red Hat sources, the scope of this issue is restricted to users who may have obtained these packages through unofficial distribution points.  As of 20080827, no unofficial distributions of this software are known.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-08-27 20:41:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-20","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"9.3","severity":"","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://www.vupen.com/english/advisories/2008/2821","name":"http://www.vupen.com/english/advisories/2008/2821","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/31575","name":"http://secunia.com/advisories/31575","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required","Third Party Advisory"],"title":"Red Hat Update for Tampered OpenSSH Packages - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1020730","name":"http://securitytracker.com/id?1020730","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"SecurityTracker.com Archives - OpenSSH for Red Hat Enterprise Linux Packages May Have Been Compromised","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32241","name":"http://secunia.com/advisories/32241","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required","Third Party Advisory"],"title":"Avaya Products Red Hat Tampered OpenSSH Packages - Advisories - Community","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0855.html","name":"http://www.redhat.com/support/errata/RHSA-2008-0855.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Not Applicable"],"title":"Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm","name":"http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"ASA-2008-399 (RHSA-2008-0855)","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://www.redhat.com/security/data/openssh-blacklist.html","name":"http://www.redhat.com/security/data/openssh-blacklist.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"redhat.com | OpenSSH blacklist script","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44747","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44747","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/30794","name":"http://www.securityfocus.com/bid/30794","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Red Hat OpenSSH Backdoor Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-3844","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-3844","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"3844","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openbsd","cpe5":"openssh","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"3844","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux","cpe6":"4.5.z","cpe7":"*","cpe8":"as","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"3844","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux","cpe6":"4.5.z","cpe7":"*","cpe8":"es","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"3844","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux","cpe6":"5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"3844","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux_desktop","cpe6":"4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"3844","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux_desktop","cpe6":"5","cpe7":"*","cpe8":"client","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T09:53:00.389Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.redhat.com/security/data/openssh-blacklist.html"},{"name":"ADV-2008-2821","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/2821"},{"name":"31575","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/31575"},{"name":"RHSA-2008:0855","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://www.redhat.com/support/errata/RHSA-2008-0855.html"},{"name":"openssh-rhel-backdoor(44747)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44747"},{"name":"1020730","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1020730"},{"name":"30794","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/30794"},{"name":"32241","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32241"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-08-22T00:00:00.000Z","descriptions":[{"lang":"en","value":"Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain an externally introduced modification (Trojan Horse) that allows the package authors to have an unknown impact.  NOTE: since the malicious packages were not distributed from any official Red Hat sources, the scope of this issue is restricted to users who may have obtained these packages through unofficial distribution points.  As of 20080827, no unofficial distributions of this software are known."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-07T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.redhat.com/security/data/openssh-blacklist.html"},{"name":"ADV-2008-2821","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/2821"},{"name":"31575","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/31575"},{"name":"RHSA-2008:0855","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://www.redhat.com/support/errata/RHSA-2008-0855.html"},{"name":"openssh-rhel-backdoor(44747)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44747"},{"name":"1020730","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1020730"},{"name":"30794","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/30794"},{"name":"32241","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32241"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-3844","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain an externally introduced modification (Trojan Horse) that allows the package authors to have an unknown impact.  NOTE: since the malicious packages were not distributed from any official Red Hat sources, the scope of this issue is restricted to users who may have obtained these packages through unofficial distribution points.  As of 20080827, no unofficial distributions of this software are known."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm","refsource":"CONFIRM","url":"http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm"},{"name":"http://www.redhat.com/security/data/openssh-blacklist.html","refsource":"CONFIRM","url":"http://www.redhat.com/security/data/openssh-blacklist.html"},{"name":"ADV-2008-2821","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/2821"},{"name":"31575","refsource":"SECUNIA","url":"http://secunia.com/advisories/31575"},{"name":"RHSA-2008:0855","refsource":"REDHAT","url":"http://www.redhat.com/support/errata/RHSA-2008-0855.html"},{"name":"openssh-rhel-backdoor(44747)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44747"},{"name":"1020730","refsource":"SECTRACK","url":"http://securitytracker.com/id?1020730"},{"name":"30794","refsource":"BID","url":"http://www.securityfocus.com/bid/30794"},{"name":"32241","refsource":"SECUNIA","url":"http://secunia.com/advisories/32241"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-3844","datePublished":"2008-08-27T20:00:00.000Z","dateReserved":"2008-08-27T00:00:00.000Z","dateUpdated":"2024-08-07T09:53:00.389Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-08-27 20:41:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-20","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:redhat:enterprise_linux:4.5.z:*:as:*:*:*:*:*","matchCriteriaId":"9E17C039-50DC-487F-B800-8694C2E733FA"},{"vulnerable":false,"criteria":"cpe:2.3:o:redhat:enterprise_linux:4.5.z:*:es:*:*:*:*:*","matchCriteriaId":"B380DA56-B6E4-4735-A66C-EE29B56D7A52"},{"vulnerable":false,"criteria":"cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*","matchCriteriaId":"1D8B549B-E57B-4DFE-8A13-CAB06B5356B3"},{"vulnerable":false,"criteria":"cpe:2.3:o:redhat:enterprise_linux_desktop:4:*:*:*:*:*:*:*","matchCriteriaId":"D986CAD0-F4E0-4F97-B240-8967CD4466FB"},{"vulnerable":false,"criteria":"cpe:2.3:o:redhat:enterprise_linux_desktop:5:*:client:*:*:*:*:*","matchCriteriaId":"AF3FB21C-AC0E-4F6C-B68A-9405E57ADCF0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*","matchCriteriaId":"C6D7D468-C829-4A4E-8865-E62D8EC5E274"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"3844","Ordinal":"1","Title":"CVE-2008-3844","CVE":"CVE-2008-3844","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"3844","Ordinal":"1","NoteData":"Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain an externally introduced modification (Trojan Horse) that allows the package authors to have an unknown impact.  NOTE: since the malicious packages were not distributed from any official Red Hat sources, the scope of this issue is restricted to users who may have obtained these packages through unofficial distribution points.  As of 20080827, no unofficial distributions of this software are known.","Type":"Description","Title":"CVE-2008-3844"},{"CveYear":"2008","CveId":"3844","Ordinal":"2","NoteData":"2008-08-27","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"3844","Ordinal":"3","NoteData":"2017-08-07","Type":"Other","Title":"Modified"}]}}}