CVE-2009-2904

no score yetEPSS 0.3%

A certain Red Hat modification to the ChrootDirectory feature in OpenSSH 4.8, as used in sshd in OpenSSH 4.3 in Red Hat Enterprise Linux (RHEL) 5.4 and Fedora 11, allows local users to gain privileges via hard links to setuid programs that use configuration files within the chroot directory, related to requirements for directory ownership.

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWE: CWE-16
Published: 2009-10-01
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

openbsd:openssh

References

http://lists.fedoraproject.org/pipermail/package-announce/2010-March/038214.html
http://lists.vmware.com/pipermail/security-announce/2010/000082.html
http://osvdb.org/58495
http://secunia.com/advisories/38794
http://secunia.com/advisories/38834

Check your stack JSON