The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests. NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 5.3 Openssh_advisory10 | — | — | Apr 5, 2017 | Dec 9, 2016 |
| Aix 6.1 Openssh_advisory10 | — | — | Apr 5, 2017 | Dec 9, 2016 |
| Aix 7.1 Openssh_advisory10 | — | — | Apr 5, 2017 | Dec 9, 2016 |
| Aix 7.2 Openssh_advisory10 | — | — | Apr 5, 2017 | Dec 9, 2016 |
| Debian | — | Upgrade openssh | Jul 30, 2024 | Dec 9, 2016 |
| Freebsd | — | Upgrade openssh-portableUpgrade FreeBSD | Nov 14, 2016 | Oct 29, 2016 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Oct 30, 2017 | Dec 9, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade openssh-clientsUpgrade openssh-serverUpgrade openssh-keycatUpgrade opensshUpgrade openssh-askpass | Nov 30, 2017 | Dec 9, 2016 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory10 | Nov 30, 2017 | Dec 9, 2016 |
| Openbsd Openssh | — | Upgrade to the latest version of OpenSSH | Dec 12, 2016 | Dec 9, 2016 |
| Oracle Solaris | — | Upgrade network/openssh to version 7.3.0.1-0.175.3.15.0.2.0 on Solaris 11.3 | May 29, 2017 | Dec 9, 2016 |
| Suse | — | Upgrade openssh-commonUpgrade openssh-askpassUpgrade openssh-openssl1-helpersUpgrade openssh-serverUpgrade openssh-askpass-gnomeUpgrade opensshUpgrade openssh-fipsUpgrade openssh-openssl1Upgrade openssh-clientsUpgrade openssh-helpers | Jan 24, 2017 | Dec 9, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub