sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade openssh-serverUpgrade openssh-ldapUpgrade openssh-cavsUpgrade openssh-debuginfoUpgrade opensshUpgrade pam_ssh_agent_authUpgrade openssh-server-sysvinitUpgrade openssh-clientsUpgrade openssh-askpassUpgrade openssh-keycat | Aug 28, 2019 | Jan 21, 2018 |
| Debian | — | Upgrade openssh | Feb 25, 2019 | Jan 21, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Apr 11, 2018 |
| Huawei Euleros 2_0_sp1 | — | Upgrade openssh-askpassUpgrade opensshUpgrade openssh-serverUpgrade openssh-keycatUpgrade openssh-clients | Mar 16, 2018 | Jan 21, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade openssh-serverUpgrade openssh-clientsUpgrade openssh-askpassUpgrade opensshUpgrade openssh-keycat | Mar 16, 2018 | Jan 21, 2018 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 7.4 | Feb 12, 2018 | Jan 21, 2018 |
| Redhat_linux | — | Upgrade openssh-askpassUpgrade openssh-server-sysvinitUpgrade opensshUpgrade openssh-cavsUpgrade openssh-clientsUpgrade openssh-keycatUpgrade openssh-debuginfoUpgrade pam_ssh_agent_authUpgrade openssh-ldapUpgrade openssh-serverNo solution exists | Feb 7, 2018 | Aug 1, 2017 |
| Suse | — | Upgrade openssh-openssl1Upgrade openssh-helpersUpgrade openssh-fipsUpgrade opensshUpgrade openssh-askpass-gnomeUpgrade openssh-askpassUpgrade openssh-openssl1-helpers | Jul 20, 2018 | Jan 21, 2018 |
| Ubuntu | — | Upgrade openssh-server | Nov 13, 2018 | Jan 21, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub