Backdoored library loaded into sshd (cve 2024 3094)

This event indicates that a backdoored library has been loaded into the SSHD process in the Kubernetes cluster, potentially compromising the security of the system.
To investigate further, you can check the logs of the SSHD pod where the event occurred using the following command: kubectl logs <sshd-pod-name>
To mitigate this issue, you should immediately remove the compromised SSHD pod from the cluster and replace it with a clean, secure version using the following command: kubectl delete pod <sshd-pod-name>

Create a ConfigMap containing the updated SSHD configuration to remove the backdoored library:
kubectl create configmap sshd-config --from-file=sshd_config_updated

Update the SSHD Deployment to mount the ConfigMap containing the updated configuration:

kubectl set volume deployment/sshd-deployment --add --name=sshd-config-volume --type=configmap --configmap-name=sshd-config --mount-path=/etc/sshd

Rollout the updated SSHD Deployment to apply the remediation changes:
kubectl rollout restart deployment/sshd-deployment