The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 5.3 Openssh_advisory8 | — | — | Dec 19, 2016 | Dec 19, 2016 |
| Aix 6.1 Openssh_advisory8 | — | — | Dec 19, 2016 | Dec 19, 2016 |
| Aix 7.1 Openssh_advisory8 | — | — | Dec 19, 2016 | Dec 19, 2016 |
| Aix 7.2 Openssh_advisory8 | — | — | Dec 19, 2016 | Dec 19, 2016 |
| Centos_linux | — | Upgrade openssh-askpassUpgrade opensshUpgrade pam_ssh_agent_authUpgrade openssh-server-sysvinitUpgrade openssh-serverUpgrade openssh-keycatUpgrade openssh-clientsUpgrade openssh-ldap | Jul 6, 2016 | Mar 21, 2016 |
| Debian | — | Upgrade openssh | Feb 20, 2019 | Apr 11, 2017 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Oct 30, 2017 | Apr 11, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade openssh-serverUpgrade openssh-clientsUpgrade openssh-askpassUpgrade opensshUpgrade openssh-keycat | Nov 30, 2017 | Apr 11, 2017 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory8 | Nov 30, 2017 | Apr 11, 2017 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 7.2 | Apr 19, 2017 | Apr 11, 2017 |
| Oracle_linux | — | Upgrade opensshUpgrade openssh-clientsUpgrade openssh-askpassUpgrade openssh-server-sysvinitUpgrade pam_ssh_agent_authUpgrade openssh-keycatUpgrade openssh-ldapUpgrade openssh-server | Apr 11, 2017 | Apr 11, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 14, 2016 |
| Suse | — | Upgrade openssh-fipsUpgrade openssh-openssl1-helpersUpgrade openssh-helpersUpgrade openssh-askpass-gnomeUpgrade openssh-openssl1Upgrade opensshUpgrade openssh-askpass | May 24, 2016 | Mar 21, 2016 |
| Ubuntu | — | Upgrade openssh-server | May 9, 2016 | Mar 21, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub