id: CVE-2024-6387 - OpenSSH RegreSSHion RCE
version: -1
name: CVE-2024-6387 - OpenSSH RegreSSHion RCE
description: |-
  RegreSSHion Vulnerability (CVE-2024-6387)

  On July 1, 2024, a critical signal handler race condition vulnerability was disclosed in OpenSSH servers (sshd) on glibc-based Linux systems. This vulnerability, known as RegreSSHion and tracked as CVE-2024-6387, can result in unauthenticated remote code execution (RCE) with root privileges. This vulnerability has been rated High severity (CVSS 8.1).

  #### Impacted Versions

  The vulnerability impacts the following OpenSSH server versions:

  - OpenSSH versions between 8.5p1 and 9.8p1
  - OpenSSH versions earlier than 4.4p1, if they have not been backport-patched against CVE-2006-5051 or patched against CVE-2008-4109

  #### Unaffected Versions

  The SSH features in PAN-OS are not affected by CVE-2024-6387.

  ### The playbook includes the following tasks:

  **Collect, Extract and Enrich Indicators**
  * Collect known indicators from Unit42 blog

  **Threat Hunting**
  * Searches vulnerable endpoints using Prisma Cloud and Cortex XDR - XQL queries

  **Mitigations:**
  * OpenSSH official CVE-2024-6387 patch
  * Unit42 recommended mitigations
  
  **This playbook should be triggered manually or can be configured as a job.** 

  Please create a new incident and choose the CVE-2024-6387 - OpenSSH RegreSSHion RCE playbook and Rapid Breach Response incident type.
  
  Reference:
  
  [Threat Brief: CVE-2024-6387 OpenSSH RegreSSHion Vulnerability
  ](https://unit42.paloaltonetworks.com/threat-brief-cve-2024-6387-openssh/).
  
  Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 94adeb69-7e9a-4a89-8765-b6752c05df1c
    type: start
    task:
      id: 94adeb69-7e9a-4a89-8765-b6752c05df1c
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 7a39d8d2-ac92-445a-8854-ebc57270e381
    type: regular
    task:
      id: 7a39d8d2-ac92-445a-8854-ebc57270e381
      version: -1
      name: Collect Indicators from Unit42
      description: This script will extract indicators from given HTML and will handle bad top-level domains to avoid false positives caused by file extensions.
      scriptName: ParseHTMLIndicators
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      url:
        simple: https://unit42.paloaltonetworks.com/threat-brief-cve-2024-6387-openssh/
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 06591089-1b00-4ab7-8b90-f11ff525fae2
    type: title
    task:
      id: 06591089-1b00-4ab7-8b90-f11ff525fae2
      version: -1
      name: Extract and Tag Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: b38ed8c9-cd4f-46c1-83f6-0ebf43f5378c
    type: regular
    task:
      id: b38ed8c9-cd4f-46c1-83f6-0ebf43f5378c
      version: -1
      name: Create indicators in TIM
      description: commands.local.cmd.new.indicator
      script: Builtin|||createNewIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      tags:
        simple: RegreSSHion, OpenSSH, RCE
      type:
        simple: CVE
      value:
        complex:
          root: ExtractedIndicators
          accessor: CVE
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 646abc1c-8377-4cf4-861c-e6d26647af4d
    type: regular
    task:
      id: 646abc1c-8377-4cf4-861c-e6d26647af4d
      version: -1
      name: Extract Indicators
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      text:
        simple: ${http.parsedBlog.indicators}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 315
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: c4f179ef-d905-46f5-8743-3f39170e36cf
    type: title
    task:
      id: c4f179ef-d905-46f5-8743-3f39170e36cf
      version: -1
      name: Collect Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 8fd54c1e-180d-45de-8def-93fc184bbf6c
    type: title
    task:
      id: 8fd54c1e-180d-45de-8def-93fc184bbf6c
      version: -1
      name: Handle Rapid Breach Response Layout
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: d89e9319-fe26-4a4f-89e5-4a42203a3c15
    type: playbook
    task:
      id: d89e9319-fe26-4a4f-89e5-4a42203a3c15
      version: -1
      name: Rapid Breach Response - Set Incident Info
      description: This playbook is responsible for setting up the Rapid Breach Response Incident Info tab in the layout.
      playbookName: Rapid Breach Response - Set Incident Info
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      SourceOfIndicators:
        simple: ${http.parsedBlog.sourceLink}
      countTotalIndicators:
        complex:
          root: ExtractedIndicators
          accessor: CVE
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.Domain
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.IP
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.URL
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
          - operator: uniq
          - operator: count
      playbookDescription:
        simple: ${inputs.PlaybookDescription}
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 450,
          "y": 940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: ef31c540-d451-4ea9-8d4a-a852e9783e45
    type: title
    task:
      id: ef31c540-d451-4ea9-8d4a-a852e9783e45
      version: -1
      name: Threat Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
      - "11"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 878e0ae1-e27b-48d1-8424-b64258a88ccd
    type: title
    task:
      id: 878e0ae1-e27b-48d1-8424-b64258a88ccd
      version: -1
      name: Unit42 Managed Threat Hunting Queries
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 200,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 8773b606-9c32-4742-845e-bf425534ff68
    type: title
    task:
      id: 8773b606-9c32-4742-845e-bf425534ff68
      version: -1
      name: Prisma Cloud
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 690,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 6bb9d8a2-00c1-4380-87c9-e46aad6c1610
    type: condition
    task:
      id: 6bb9d8a2-00c1-4380-87c9-e46aad6c1610
      version: -1
      name: Should run XQL hunting queries?
      description: Whether to run the XQL hunting queries.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "15"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.RunXQLHuntingQueries
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 200,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 475304b6-8672-4e31-8f85-80a0c142b107
    type: condition
    task:
      id: 475304b6-8672-4e31-8f85-80a0c142b107
      version: -1
      name: Check if Cortex XDR - XQL Query Engine is Enabled
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "15"
      "yes":
      - "14"
    scriptarguments:
      brandname:
        simple: Cortex XDR - XQL Query Engine
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 10,
          "y": 1560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: dd7a29c0-0024-4d25-83dd-90629841e2d8
    type: regular
    task:
      id: dd7a29c0-0024-4d25-83dd-90629841e2d8
      version: -1
      name: Hunt to identify hosts vulnerable to CVE-2024-6387
      description: |-
        Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised.
        When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file,
        unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      ignore-outputs:
        simple: "false"
      parse_result_file_to_context:
        simple: "true"
      query:
        simple: "preset = host_inventory_applications\n \n| filter endpoint_type = ENUM.AGENT_TYPE_SERVER\n \n| filter lowercase(application_name) ~= \"openssh(-server)?\"\n \n| alter product_major_version = to_number(arrayindex(split(raw_version, \".\"), 0)),\n \nproduct_minor_version_stage_1 = arrayindex(split(raw_version, \".\"), 1),\n \nproduct_rev = to_number(arrayindex(split(raw_version, \"p\"), 1))\n \n| alter product_minor_version = to_number(arrayindex(split(product_minor_version_stage_1, \"p\"), 0))\n \n// (name:\"openssh\" and version<4.4) or (name:\"openssh\" and version<9.8 and version>=8.5)\n \n| filter product_major_version < 4 or (product_major_version = 4 and product_minor_version < 4) or (product_major_version = 8 and product_minor_version >= 5) or (product_major_version = 9 and product_minor_version < 8)\n \n| fields endpoint_name, application_name, raw_version, product_major_version, product_minor_version, product_rev\n \n| dedup endpoint_name"
      query_name:
        simple: Hunt_CVE_-_2024_-_6387_Vulnerable_Endpoints
      time_frame:
        simple: 7 days
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -180,
          "y": 1740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: ac1b6020-ac56-402d-8b1e-87cf2cf78e3a
    type: condition
    task:
      id: ac1b6020-ac56-402d-8b1e-87cf2cf78e3a
      version: -1
      name: Were vulnerable endpoints found?
      description: Checks if vulnerable endpoints found in the Threat Hunting phase.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "29"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: PaloAltoNetworksXQL.GenericQuery.results
                accessor: endpoint_name
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: PrismaCloudCompute.CIScan.entityInfo.hostname
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: Expanse.Issue.assets.id
                      iscontext: true
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 23f98158-0f08-46a6-888f-27577dc36a5b
    type: regular
    task:
      id: 23f98158-0f08-46a6-888f-27577dc36a5b
      version: -1
      name: Search for vulnerable resources
      description: Retrieves all scan reports for images scanned by the Jenkins plugin or twistcli. Maps to Monitor > Vulnerabilities > Images > CI in the Console UI. The default will retrieve only the passed scans.
      script: '|||prisma-cloud-compute-ci-scan-results-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      all_results:
        simple: "true"
      search:
        simple: vulnerability where asset.type = 'all' AND cve.id = 'CVE-2024-6387'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 690,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 363fd235-f892-4edb-8666-b357dff8438c
    type: title
    task:
      id: 363fd235-f892-4edb-8666-b357dff8438c
      version: -1
      name: Mitigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 1ef81cb4-1c73-4b84-8cc2-fe5480c470e8
    type: collection
    task:
      id: 1ef81cb4-1c73-4b84-8cc2-fe5480c470e8
      version: -1
      name: Hold for an update regarding the endpoint mitigation
      description: commands.local.cmd.todo.add
      type: collection
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      description:
        simple: "The following endpoints have are potentially vulnerable to CVE-2024-6387:\n\nXQL Threat Hunting\n${PaloAltoNetworksXQL.GenericQuery.results.endpoint_name}\n\nPrisma Cloud Compute\n${PrismaCloudCompute.CIScan.entityInfo.hostname}\n\nCortex Xpanse\n${Expanse.Issue.assets.id}\n\nUnit42 recommended mitigations for CVE-2024-6387 are:\n\n1. Update to OpenSSH 9.8p1 or later\nReference: [OpenSSH 9.8](https://www.openssh.com/txt/release-9.8)\n\n2. Harden SSH Configuration\n- LoginGraceTime: Reduce the LoginGraceTime value to minimize the window during which an attacker can attempt to exploit the SSH service. \n    - Open /etc/ssh/sshd_config as root\n    - Add or modify the LoginGraceTime parameter:\n    LoginGraceTime 0\n    - Save the file\n    - Restart the sshd service"
      tags:
        simple: CVE-2024-6387, OpenSSH, RegreSSHion
      title:
        simple: Mitigate Vulnerable Endpoints
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Which endpoints have been mitigated?
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: PrismaCloudCompute.CIScan.entityInfo
            accessor: hostname
            transformers:
            - operator: append
              args:
                item:
                  value:
                    simple: PaloAltoNetworksXQL.GenericQuery.results.endpoint_name
                  iscontext: true
        - {}
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Please select mitigated endpoints
      description: ""
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: f4877f7c-e71f-43ae-8162-ad2c13e1fbd1
    type: title
    task:
      id: f4877f7c-e71f-43ae-8162-ad2c13e1fbd1
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: bbbcc8f0-fed8-40ab-8517-d5eb2aafb994
    type: regular
    task:
      id: bbbcc8f0-fed8-40ab-8517-d5eb2aafb994
      version: -1
      name: Recommended Mitigations
      description: |-
        Pretty-print data using Python's pprint library.  This is useful for seeing the structure of incident and context data.  Here's how to use it:

        !PrettyPrint value=${incident}
      scriptName: PrettyPrint
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      value:
        simple: |-
          The Unit42 Research team recommends these mitigations:

          1. Upgrade OpenSSH to a patched version 9.8p1 or later.
          2. Harden your OpenSSH LoginGraceTime configuration
              - Open /etc/ssh/sshd_config as root
              - Add or modify the LoginGraceTime parameter as follows:
                  LoginGraceTime 0
              - Save the file
              - Restart the sshd service
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: c77a3225-393a-4519-8eec-77d11464b604
    type: regular
    task:
      id: c77a3225-393a-4519-8eec-77d11464b604
      version: -1
      name: Notify the SOC about the vulnerable endpoints
      description: commands.server.mail.sendmail
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      body:
        simple: |-
          Dear SOC,

          The CVE-2024-6387 - OpenSSH RegreSSHion RCE playbook found potentially vulnerable endpoints:

          Prisma Cloud
          ${PrismaCloudCompute.CIScan.entityInfo.hostname}

          Managed Threat Hunting Queries
          ${PaloAltoNetworksXQL.GenericQuery.results.endpoint_name}

          Please follow the steps described in the playbook to mitigate the threat.

          Best regards,
          Cortex XSOAR
      subject:
        simple: Cortex XSOAR - Incident ${incident.id} - CVE-2024-6387 Vulnerable Endpoints
      to:
        simple: ${inputs.SOCEmailAddress}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 551deed2-69b7-491a-8eb6-e4a06d4b0dcd
    type: condition
    task:
      id: 551deed2-69b7-491a-8eb6-e4a06d4b0dcd
      version: -1
      name: Should notify the SOC by email?
      description: Whether to notify the SOC about the affected assets by email.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "20"
      "yes":
      - "28"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.ShouldSendMail
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 1ae47a6a-03c1-4664-83c7-b0133bc6c218
    type: regular
    task:
      id: 1ae47a6a-03c1-4664-83c7-b0133bc6c218
      version: -1
      name: Enrich Indicators
      description: commands.local.cmd.enrich.indicators
      script: Builtin|||enrichIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      indicatorsValues:
        complex:
          root: ExtractedIndicators
          accessor: CVE
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.Domain
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.IP
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.URL
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "12_13_yes": 0.25,
      "12_15_#default#": 0.27,
      "13_14_yes": 0.39,
      "13_15_no": 0.28,
      "15_26_#default#": 0.32,
      "15_29_yes": 0.4,
      "29_28_yes": 0.4
    },
    "paper": {
      "dimensions": {
        "height": 3195,
        "width": 1250,
        "x": -180,
        "y": -240
      }
    }
  }
inputs:
- key: PlaybookDescription
  value:
    simple: |-
      RegreSSHion Vulnerability (CVE-2024-6387)

      On July 1, 2024, a critical signal handler race condition vulnerability was disclosed in OpenSSH servers (sshd) on glibc-based Linux systems. This vulnerability, known as RegreSSHion and tracked as CVE-2024-6387, can result in unauthenticated remote code execution (RCE) with root privileges. This vulnerability has been rated High severity (CVSS 8.1).

      ## Impacted Versions

      The vulnerability impacts the following OpenSSH server versions:

      - OpenSSH versions between 8.5p1 and 9.8p1
      - OpenSSH versions earlier than 4.4p1, if they have not been backport-patched against CVE-2006-5051 or patched against CVE-2008-4109

      ## Unaffected Versions

      The SSH features in PAN-OS are not affected by CVE-2024-6387.
  required: false
  description: The playbook description to populate the layout with.
  playbookInputQuery:
- key: RunXQLHuntingQueries
  value:
    simple: "True"
  required: false
  description: Whether to execute the XQL query.
  playbookInputQuery:
- key: ShouldSendMail
  value:
    simple: "False"
  required: false
  description: Whether to notify the SOC by email.
  playbookInputQuery:
- key: SOCEmailAddress
  value: {}
  required: false
  description: The email address to notify
  playbookInputQuery:
inputSections:
- inputs:
  - PlaybookDescription
  - RunXQLHuntingQueries
  - ShouldSendMail
  - SOCEmailAddress
  name: General (Inputs group)
  description: Generic group for inputs
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0