The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 5.3 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Aix 6.1 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Aix 7.1 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Aix 7.2 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Alpine Linux | — | Upgrade openssh | Aug 30, 2017 | Aug 7, 2016 |
| Amazon_linux | — | Upgrade openssh | Oct 3, 2017 | Aug 7, 2016 |
| Centos_linux | — | Upgrade openssh-ldapUpgrade openssh-serverUpgrade openssh-cavsUpgrade openssh-keycatUpgrade opensshUpgrade openssh-debuginfoUpgrade openssh-askpassUpgrade openssh-clientsUpgrade pam_ssh_agent_authUpgrade openssh-server-sysvinit | Aug 28, 2019 | Aug 7, 2016 |
| Debian | — | Upgrade openssh | Mar 31, 2017 | Aug 7, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 19, 2016 |
| Freebsd | — | Upgrade FreeBSD | Oct 3, 2017 | Oct 3, 2017 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory9 | Nov 30, 2017 | Aug 7, 2016 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 7.3 | Aug 12, 2016 | Aug 7, 2016 |
| Oracle_linux | — | Upgrade pam_ssh_agent_authUpgrade openssh-ldapUpgrade openssh-keycatUpgrade openssh-serverUpgrade openssh-askpassUpgrade openssh-server-sysvinitUpgrade openssh-cavsUpgrade opensshUpgrade openssh-clients | Aug 8, 2017 | Jul 21, 2016 |
| Redhat_linux | — | Upgrade opensshNo solution existsUpgrade openssh-debuginfoUpgrade openssh-askpassUpgrade openssh-ldapUpgrade openssh-serverUpgrade openssh-cavsUpgrade openssh-keycatUpgrade pam_ssh_agent_authUpgrade openssh-server-sysvinitUpgrade openssh-clients | Aug 3, 2017 | Aug 7, 2016 |
| Suse | — | Upgrade openssh-askpassUpgrade opensshUpgrade openssh-askpass-gnomeUpgrade openssh-openssl1-helpersUpgrade openssh-clientsUpgrade openssh-commonUpgrade openssh-fipsUpgrade openssh-helpersUpgrade openssh-openssl1Upgrade openssh-server | Sep 12, 2016 | Aug 7, 2016 |
| Ubuntu | — | Upgrade openssh-server | Aug 17, 2016 | Aug 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub