The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 5.3 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Aix 6.1 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Aix 7.1 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Aix 7.2 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Alpine Linux | — | Upgrade openssh | Aug 30, 2017 | Aug 7, 2016 |
| Amazon_linux | — | Upgrade openssh | Oct 3, 2017 | Aug 7, 2016 |
| Centos_linux | — | Upgrade openssh-ldapUpgrade openssh-keycatUpgrade openssh-debuginfoUpgrade openssh-serverUpgrade opensshUpgrade openssh-cavsUpgrade openssh-askpassUpgrade openssh-server-sysvinitUpgrade pam_ssh_agent_authUpgrade openssh-clients | Aug 28, 2019 | Aug 7, 2016 |
| Debian | — | Upgrade openssh | Mar 31, 2017 | Aug 7, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 19, 2016 |
| Freebsd | — | Upgrade FreeBSD | Oct 3, 2017 | Oct 3, 2017 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory9 | Nov 30, 2017 | Aug 7, 2016 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 7.3 | Aug 12, 2016 | Aug 7, 2016 |
| Oracle_linux | — | Upgrade openssh-cavsUpgrade openssh-askpassUpgrade openssh-server-sysvinitUpgrade opensshUpgrade openssh-clientsUpgrade pam_ssh_agent_authUpgrade openssh-ldapUpgrade openssh-keycatUpgrade openssh-server | Aug 8, 2017 | Jul 21, 2016 |
| Redhat_linux | — | Upgrade openssh-debuginfoUpgrade openssh-ldapNo solution existsUpgrade openssh-serverUpgrade openssh-askpassUpgrade opensshUpgrade openssh-cavsUpgrade openssh-clientsUpgrade pam_ssh_agent_authUpgrade openssh-keycatUpgrade openssh-server-sysvinit | Aug 3, 2017 | Aug 7, 2016 |
| Suse | — | Upgrade openssh-commonUpgrade openssh-askpass-gnomeUpgrade openssh-askpassUpgrade opensshUpgrade openssh-clientsUpgrade openssh-fipsUpgrade openssh-openssl1-helpersUpgrade openssh-helpersUpgrade openssh-openssl1Upgrade openssh-server | Sep 12, 2016 | Aug 7, 2016 |
| Ubuntu | — | Upgrade openssh-server | Aug 17, 2016 | Aug 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub