Question

During an authenticated vulnerability scan of a Debian-based web server, the scanner flags OpenSSH as vulnerable to a critical CVE, citing the reported version banner of 8.4p1. The client insists the system is fully patched via their standard apt update process. Before including this finding in the report, what is the MOST accurate way for you to determine whether this is a false positive?

Accepted Answer

Check the installed package changelog with 'dpkg -l openssh-server' and 'apt changelog openssh-server' to confirm whether the vendor backported the security fix without changing the version banner

Answer

Run the exploit proof-of-concept against the SSH service in production to see if it succeeds

Answer

Trust the scanner's CVSS score and version match, and include the finding as critical since the banner clearly shows 8.4p1

Answer

Re-run the scan with an unauthenticated profile to compare the two banner results