OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Openssh | apple-osx-upgrade-latest | Oct 31, 2024 | Jul 2, 2024 | |
| Aruba Aos Cx | aruba-aos-cx-cve-2024-39894 | Jun 3, 2026 | Jun 2, 2026 | |
| Freebsd | freebsd-upgrade-base-14_1-release-p7 | Jan 31, 2025 | Jan 30, 2025 | |
| Suse | — | suse-upgrade-opensshsuse-upgrade-openssh-askpass-gnomesuse-upgrade-openssh-cavssuse-upgrade-openssh-clientssuse-upgrade-openssh-commonsuse-upgrade-openssh-fipssuse-upgrade-openssh-helperssuse-upgrade-openssh-serversuse-upgrade-openssh-server-config-disallow-rootloginsuse-upgrade-openssh-server-config-rootlogin | Jul 11, 2024 | Jul 2, 2024 |
| Ubuntu | ubuntu-upgrade-openssh-clientubuntu-upgrade-openssh-server | Jul 10, 2024 | Jul 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub