The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 5.3 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Aix 6.1 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Aix 7.1 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Aix 7.2 Openssh_advisory9 | — | — | Dec 19, 2016 | Aug 7, 2016 |
| Alpine Linux | — | Upgrade openssh | Aug 30, 2017 | Aug 7, 2016 |
| Amazon_linux | — | Upgrade openssh | Oct 3, 2017 | Aug 7, 2016 |
| Centos_linux | — | Upgrade openssh-debuginfoUpgrade openssh-keycatUpgrade openssh-serverUpgrade openssh-cavsUpgrade opensshUpgrade openssh-askpassUpgrade openssh-ldapUpgrade openssh-server-sysvinitUpgrade pam_ssh_agent_authUpgrade openssh-clients | Aug 28, 2019 | Aug 7, 2016 |
| Debian | — | Upgrade openssh | Mar 31, 2017 | Aug 7, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 19, 2016 |
| Freebsd | — | Upgrade FreeBSD | Oct 3, 2017 | Oct 3, 2017 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory9 | Nov 30, 2017 | Aug 7, 2016 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 7.3 | Aug 12, 2016 | Aug 7, 2016 |
| Oracle_linux | — | Upgrade openssh-serverUpgrade openssh-keycatUpgrade openssh-ldapUpgrade pam_ssh_agent_authUpgrade opensshUpgrade openssh-cavsUpgrade openssh-clientsUpgrade openssh-server-sysvinitUpgrade openssh-askpass | Aug 8, 2017 | Jul 21, 2016 |
| Redhat_linux | — | Upgrade openssh-server-sysvinitUpgrade pam_ssh_agent_authUpgrade openssh-keycatUpgrade openssh-clientsUpgrade openssh-serverNo solution existsUpgrade openssh-ldapUpgrade openssh-debuginfoUpgrade opensshUpgrade openssh-cavsUpgrade openssh-askpass | Aug 3, 2017 | Aug 7, 2016 |
| Suse | — | Upgrade openssh-serverUpgrade openssh-openssl1Upgrade openssh-helpersUpgrade openssh-askpass-gnomeUpgrade openssh-commonUpgrade openssh-clientsUpgrade openssh-askpassUpgrade openssh-openssl1-helpersUpgrade openssh-fipsUpgrade openssh | Sep 12, 2016 | Aug 7, 2016 |
| Ubuntu | — | Upgrade openssh-server | Aug 17, 2016 | Aug 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub