The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests. NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 5.3 Openssh_advisory10 | — | — | Apr 5, 2017 | Dec 9, 2016 |
| Aix 6.1 Openssh_advisory10 | — | — | Apr 5, 2017 | Dec 9, 2016 |
| Aix 7.1 Openssh_advisory10 | — | — | Apr 5, 2017 | Dec 9, 2016 |
| Aix 7.2 Openssh_advisory10 | — | — | Apr 5, 2017 | Dec 9, 2016 |
| Debian | — | Upgrade openssh | Jul 30, 2024 | Dec 9, 2016 |
| Freebsd | — | Upgrade FreeBSDUpgrade openssh-portable | Nov 14, 2016 | Oct 29, 2016 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Oct 30, 2017 | Dec 9, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade openssh-askpassUpgrade openssh-keycatUpgrade opensshUpgrade openssh-serverUpgrade openssh-clients | Nov 30, 2017 | Dec 9, 2016 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory10 | Nov 30, 2017 | Dec 9, 2016 |
| Openbsd Openssh | — | Upgrade to the latest version of OpenSSH | Dec 12, 2016 | Dec 9, 2016 |
| Oracle Solaris | — | Upgrade network/openssh to version 7.3.0.1-0.175.3.15.0.2.0 on Solaris 11.3 | May 29, 2017 | Dec 9, 2016 |
| Suse | — | Upgrade openssh-askpass-gnomeUpgrade openssh-clientsUpgrade opensshUpgrade openssh-openssl1Upgrade openssh-helpersUpgrade openssh-fipsUpgrade openssh-openssl1-helpersUpgrade openssh-askpassUpgrade openssh-commonUpgrade openssh-server | Jan 24, 2017 | Dec 9, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub