Openssh flaw not detected

[Tiggez]

Scan detects openssh on debian target.

But the CPE is wrong and no vulnerability is detected:

Wrong CPE: cpe:/a:openbsd:openssh:9.2p1

Correct CPE: cpe:/a:openbsd:openssh:9.2:p1

CVE-2026-35414 is known by openVAS and linked to
cpe:/a:openbsd:openssh:9.2:- and cpe:/a:openbsd:openssh:9.2:p1

could be linked to:

Question about OpenSSH CPE

Hi all, I noticed that GVM reports product CPE in a wrong format when it is a patch version. For example, following is the CPE that GVM built for OpenSSH Server 8.9p1: cpe:/a:openbsd:openssh:8.9p1. The correct CPE should be cpe:/a:openbsd:openssh:8.9:p1.

Best regards

[cfi]

@Tiggez

could be linked to:

This is indeed the same as the linked thread with an explanation here:

Question about OpenSSH CPE

Hi, You messing up Patch and Portable, there is OpenSSH 8.9 and OpenSSH 8.9p1 (Portable) that is not a patch level.

and the following suggestion which is still valid these days:

Question about OpenSSH CPE

Strange enough it seems that the NVD had switched from using the “correct” CPE cpe:/a:openbsd:openssh:4.4p1 to using cpe:/a:openbsd:openssh:4.4:p1 like seen in e.g.: https://nvd.nist.gov/vuln/detail/CVE-2021-36368#range-7818946 @panajo1017 You might want to contact the NVD via https://www.nist.gov/about-nist/contact-us to get this corrected back so that the p1 isn’t added to the Update Component part of the CPE because p1 is actually not an update / patch as we have now concluded.

As this is not a NASL / VT side problem i have moved this to a better fitting category instead.

[Tiggez]

Just out of curiosity. All openvas / Debian users are affected and it is not only our system?

[cfi]

I guess it depends how the data is getting consumed. But i would say that all consumers of the NVD API data are affected, independent of the underlying technology because e.g. 9.2p1 is NOT an update / patch to 9.2 but just a different variant of the version / release line of that product.