This article outlines the impact of the recent OpenSSH Vulnerability: CVE-2024-6387 on Blancco products and provides guidance for our customers to ensure their systems are secure. This information is crucial for our customers to understand the necessary steps to mitigate any potential issues.

  1. Blancco Drive Eraser (BDE)
    • Status: Potentially affected.
    • Details: The SSH connection based on the OpenSSH library is disabled by default. Customers must manually enable it using the Blancco Drive Eraser Configuration Tool or through the Blancco Drive Eraser UI under the settings. BDE 7.13.0 will have an updated version of OpenSSH that will not include this vulnerability.
    • Action:  Don’t enable SSH until the new is BDE 7.13 released.
  2. Blancco Management Portal (BMP)
    • Status: Not affected.
    • Details: BMP does not utilize OpenSSH.
    • Action: No action is required.
  3. Cloud.blancco.com
    • Status: Patched.
    • Details: The cloud service was patched in June to address OpenSSH vulnerabilities.
    • Action: No action is required.
  4. On-Premise Blancco Management Console (BMC)
    • Status: Potentially affected.
    • Details: Customers are responsible for installing Linux or Windows operating systems for BMC, which may include vulnerable OpenSSH versions.
    • Action: Customers should always ensure that their operating systems are updated to the latest version to mitigate any security risks.


Link to this page