The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol, a related issue to CVE-2010-4252.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Gentoo Linux | — | Upgrade net-misc/openssh. | Oct 30, 2017 | Dec 6, 2010 |
| Openbsd Openssh | — | Upgrade to the latest version of OpenSSH | Dec 5, 2012 | Dec 6, 2010 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub