What were you trying to do that didn't work?

I was trying to ensure that the latest OpenSSH from CentOS Stream 9 and RHEL 9.4 are not vulnerable to CVE-2024-6387 on my systems.

Please provide the package NVR for which bug is seen:

• openssh-8.7p1-41.el9
• openssh-8.7p1-38.el9

Expected results

The packages would indicate that this is fixed and I no longer need to use the mitigation as described in the RHSA on the CVE.

Actual results

There is no fixed version available. Not in Fedora, not in CentOS, and not in RHEL.

Additional information

SUSE has released a fix to openSUSE Tumbleweed: https://code.opensuse.org/package/openssh/c/58da43198c5aa3b0e82ea5720f5f828e95765027

Additionally, AlmaLinux has released a fix.