sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade openssh-askpassUpgrade opensshUpgrade openssh-clientsUpgrade pam_ssh_agent_authUpgrade openssh-server-sysvinitUpgrade openssh-keycatUpgrade openssh-ldapUpgrade openssh-serverUpgrade openssh-debuginfoUpgrade openssh-cavs | Aug 28, 2019 | Jan 21, 2018 |
| Debian | — | Upgrade openssh | Feb 25, 2019 | Jan 21, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Apr 11, 2018 |
| Huawei Euleros 2_0_sp1 | — | Upgrade openssh-keycatUpgrade openssh-clientsUpgrade openssh-serverUpgrade opensshUpgrade openssh-askpass | Mar 16, 2018 | Jan 21, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade opensshUpgrade openssh-askpassUpgrade openssh-keycatUpgrade openssh-serverUpgrade openssh-clients | Mar 16, 2018 | Jan 21, 2018 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 7.4 | Feb 12, 2018 | Jan 21, 2018 |
| Redhat_linux | — | No solution existsUpgrade openssh-ldapUpgrade openssh-serverUpgrade pam_ssh_agent_authUpgrade openssh-keycatUpgrade openssh-cavsUpgrade openssh-server-sysvinitUpgrade openssh-clientsUpgrade openssh-debuginfoUpgrade opensshUpgrade openssh-askpass | Feb 7, 2018 | Aug 1, 2017 |
| Suse | — | Upgrade openssh-fipsUpgrade opensshUpgrade openssh-openssl1-helpersUpgrade openssh-askpass-gnomeUpgrade openssh-askpassUpgrade openssh-openssl1Upgrade openssh-helpers | Jul 20, 2018 | Jan 21, 2018 |
| Ubuntu | — | Upgrade openssh-server | Nov 13, 2018 | Jan 21, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub