The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 5.3 Openssh_advisory8 | — | — | Dec 19, 2016 | Dec 19, 2016 |
| Aix 6.1 Openssh_advisory8 | — | — | Dec 19, 2016 | Dec 19, 2016 |
| Aix 7.1 Openssh_advisory8 | — | — | Dec 19, 2016 | Dec 19, 2016 |
| Aix 7.2 Openssh_advisory8 | — | — | Dec 19, 2016 | Dec 19, 2016 |
| Centos_linux | — | Upgrade openssh-server-sysvinitUpgrade opensshUpgrade openssh-askpassUpgrade pam_ssh_agent_authUpgrade openssh-ldapUpgrade openssh-clientsUpgrade openssh-keycatUpgrade openssh-server | Jul 6, 2016 | Mar 21, 2016 |
| Debian | — | Upgrade openssh | Feb 20, 2019 | Apr 11, 2017 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Oct 30, 2017 | Apr 11, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade openssh-serverUpgrade opensshUpgrade openssh-askpassUpgrade openssh-clientsUpgrade openssh-keycat | Nov 30, 2017 | Apr 11, 2017 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory8 | Nov 30, 2017 | Apr 11, 2017 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 7.2 | Apr 19, 2017 | Apr 11, 2017 |
| Oracle_linux | — | Upgrade openssh-ldapUpgrade openssh-serverUpgrade openssh-keycatUpgrade openssh-clientsUpgrade openssh-askpassUpgrade opensshUpgrade pam_ssh_agent_authUpgrade openssh-server-sysvinit | Apr 11, 2017 | Apr 11, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 14, 2016 |
| Suse | — | Upgrade opensshUpgrade openssh-askpassUpgrade openssh-openssl1Upgrade openssh-fipsUpgrade openssh-openssl1-helpersUpgrade openssh-helpersUpgrade openssh-askpass-gnome | May 24, 2016 | Mar 21, 2016 |
| Ubuntu | — | Upgrade openssh-server | May 9, 2016 | Mar 21, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub