The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 5.3 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Aix 6.1 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Aix 7.1 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Aix 7.2 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Alpine Linux | — | Upgrade openssh | Aug 30, 2017 | Aug 7, 2016 |
| Amazon_linux | — | Upgrade openssh | Oct 3, 2017 | Aug 7, 2016 |
| Centos_linux | — | Upgrade openssh-debuginfoUpgrade opensshUpgrade openssh-serverUpgrade openssh-cavsUpgrade openssh-ldapUpgrade openssh-askpassUpgrade openssh-keycatUpgrade pam_ssh_agent_authUpgrade openssh-server-sysvinitUpgrade openssh-clients | Aug 28, 2019 | Aug 7, 2016 |
| Debian | — | Upgrade openssh | Mar 31, 2017 | Aug 7, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 19, 2016 |
| Freebsd | — | Upgrade FreeBSD | Oct 3, 2017 | Oct 3, 2017 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory9 | Nov 30, 2017 | Aug 7, 2016 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 7.3 | Aug 12, 2016 | Aug 7, 2016 |
| Oracle_linux | — | Upgrade openssh-keycatUpgrade pam_ssh_agent_authUpgrade openssh-serverUpgrade openssh-ldapUpgrade openssh-askpassUpgrade opensshUpgrade openssh-server-sysvinitUpgrade openssh-cavsUpgrade openssh-clients | Aug 8, 2017 | Jul 21, 2016 |
| Redhat_linux | — | Upgrade opensshUpgrade openssh-cavsUpgrade openssh-ldapNo solution existsUpgrade openssh-debuginfoUpgrade openssh-askpassUpgrade openssh-serverUpgrade openssh-keycatUpgrade openssh-server-sysvinitUpgrade pam_ssh_agent_authUpgrade openssh-clients | Aug 3, 2017 | Aug 7, 2016 |
| Suse | — | Upgrade openssh-openssl1Upgrade openssh-serverUpgrade openssh-helpersUpgrade openssh-askpassUpgrade openssh-clientsUpgrade openssh-openssl1-helpersUpgrade openssh-askpass-gnomeUpgrade opensshUpgrade openssh-commonUpgrade openssh-fips | Sep 12, 2016 | Aug 7, 2016 |
| Ubuntu | — | Upgrade openssh-server | Aug 17, 2016 | Aug 7, 2016 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub