The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 5.3 Openssh_advisory8 | — | — | Dec 19, 2016 | Dec 19, 2016 |
| Aix 6.1 Openssh_advisory8 | — | — | Dec 19, 2016 | Dec 19, 2016 |
| Aix 7.1 Openssh_advisory8 | — | — | Dec 19, 2016 | Dec 19, 2016 |
| Aix 7.2 Openssh_advisory8 | — | — | Dec 19, 2016 | Dec 19, 2016 |
| Centos_linux | — | Upgrade openssh-ldapUpgrade openssh-serverUpgrade openssh-keycatUpgrade openssh-clientsUpgrade openssh-server-sysvinitUpgrade opensshUpgrade pam_ssh_agent_authUpgrade openssh-askpass | Jul 6, 2016 | Mar 21, 2016 |
| Debian | — | Upgrade openssh | Feb 20, 2019 | Apr 11, 2017 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Oct 30, 2017 | Apr 11, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade openssh-keycatUpgrade openssh-clientsUpgrade openssh-serverUpgrade openssh-askpassUpgrade openssh | Nov 30, 2017 | Apr 11, 2017 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory8 | Nov 30, 2017 | Apr 11, 2017 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 7.2 | Apr 19, 2017 | Apr 11, 2017 |
| Oracle_linux | — | Upgrade openssh-askpassUpgrade openssh-keycatUpgrade openssh-server-sysvinitUpgrade openssh-clientsUpgrade opensshUpgrade pam_ssh_agent_authUpgrade openssh-serverUpgrade openssh-ldap | Apr 11, 2017 | Apr 11, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 14, 2016 |
| Suse | — | Upgrade openssh-openssl1Upgrade openssh-askpass-gnomeUpgrade openssh-fipsUpgrade openssh-openssl1-helpersUpgrade openssh-helpersUpgrade opensshUpgrade openssh-askpass | May 24, 2016 | Mar 21, 2016 |
| Ubuntu | — | Upgrade openssh-server | May 9, 2016 | Mar 21, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub