The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 5.3 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Aix 6.1 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Aix 7.1 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Aix 7.2 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Alpine Linux | — | Upgrade openssh | Aug 30, 2017 | Aug 7, 2016 |
| Amazon_linux | — | Upgrade openssh | Oct 3, 2017 | Aug 7, 2016 |
| Centos_linux | — | Upgrade openssh-keycatUpgrade openssh-cavsUpgrade openssh-ldapUpgrade openssh-serverUpgrade openssh-debuginfoUpgrade openssh-askpassUpgrade opensshUpgrade openssh-server-sysvinitUpgrade openssh-clientsUpgrade pam_ssh_agent_auth | Aug 28, 2019 | Aug 7, 2016 |
| Debian | — | Upgrade openssh | Mar 31, 2017 | Aug 7, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 19, 2016 |
| Freebsd | — | Upgrade FreeBSD | Oct 3, 2017 | Oct 3, 2017 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory9 | Nov 30, 2017 | Aug 7, 2016 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 7.3 | Aug 12, 2016 | Aug 7, 2016 |
| Oracle_linux | — | Upgrade openssh-ldapUpgrade pam_ssh_agent_authUpgrade openssh-serverUpgrade openssh-keycatUpgrade openssh-cavsUpgrade openssh-server-sysvinitUpgrade openssh-clientsUpgrade opensshUpgrade openssh-askpass | Aug 8, 2017 | Jul 21, 2016 |
| Redhat_linux | — | No solution existsUpgrade openssh-debuginfoUpgrade openssh-cavsUpgrade openssh-askpassUpgrade openssh-ldapUpgrade opensshUpgrade openssh-serverUpgrade openssh-keycatUpgrade openssh-server-sysvinitUpgrade pam_ssh_agent_authUpgrade openssh-clients | Aug 3, 2017 | Aug 7, 2016 |
| Suse | — | Upgrade openssh-commonUpgrade openssh-fipsUpgrade openssh-clientsUpgrade openssh-askpassUpgrade openssh-openssl1-helpersUpgrade openssh-askpass-gnomeUpgrade opensshUpgrade openssh-serverUpgrade openssh-openssl1Upgrade openssh-helpers | Sep 12, 2016 | Aug 7, 2016 |
| Ubuntu | — | Upgrade openssh-server | Aug 17, 2016 | Aug 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub