CVE-2008-3844: Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legi...

Security readout for executives and security teams

This CVE describes malicious OpenSSH packages for RHEL 4 and 5 that were signed with a legitimate Red Hat GPG key. Red Hat says they were not distributed through official channels, so exposure depends on whether systems used unofficial package sources. Likely exposure is narrow: RHEL 4 or 5 systems that installed the affected OpenSSH packages from unofficial distribution points. Official Red Hat distribution channels are stated as not affected in the CVE description. Treat as a targeted legacy supply-chain risk. It is urgent only if the organization still operates RHEL 4/5-era systems or inherited OpenSSH packages from unofficial sources. Mitigation focus: Inventory RHEL 4 and 5 systems running OpenSSH packages from August 2008.; Check Red Hat advisory and blacklist guidance for package identification.; Replace suspect OpenSSH packages with trusted vendor-provided packages..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.