The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-openssh | Aug 30, 2017 | Aug 7, 2016 | |
| Amazon_linux | — | amazon-linux-upgrade-openssh | Oct 3, 2017 | Aug 7, 2016 |
| Centos_linux | — | centos-upgrade-opensshcentos-upgrade-openssh-askpasscentos-upgrade-openssh-cavscentos-upgrade-openssh-clientscentos-upgrade-openssh-debuginfocentos-upgrade-openssh-keycatcentos-upgrade-openssh-ldapcentos-upgrade-openssh-servercentos-upgrade-openssh-server-sysvinitcentos-upgrade-pam_ssh_agent_auth | Aug 28, 2019 | Aug 7, 2016 |
| Debian | debian-upgrade-openssh | Mar 31, 2017 | Aug 7, 2016 | |
| F5 Big Ip | f5-bigip-upgrade-latest | Jun 17, 2026 | Oct 19, 2016 | |
| Freebsd | freebsd-upgrade-base-11_1-release-p1freebsd-upgrade-base-11_0-release-p12freebsd-upgrade-base-10_3-release-p21 | Oct 3, 2017 | Oct 3, 2017 | |
| Ibm Aix | ibm-aix-openssh_advisory9 | Nov 30, 2017 | Aug 7, 2016 | |
| Openbsd Openssh | openbsd-openssh-upgrade-7_3 | Aug 12, 2016 | Aug 7, 2016 | |
| Oracle_linux | — | oracle-linux-upgrade-opensshoracle-linux-upgrade-openssh-askpassoracle-linux-upgrade-openssh-cavsoracle-linux-upgrade-openssh-clientsoracle-linux-upgrade-openssh-keycatoracle-linux-upgrade-openssh-ldaporacle-linux-upgrade-openssh-serveroracle-linux-upgrade-openssh-server-sysvinitoracle-linux-upgrade-pam-ssh-agent-auth | Aug 8, 2017 | Jul 21, 2016 |
| Redhat_linux | — | redhat-upgrade-opensshredhat-upgrade-openssh-askpassredhat-upgrade-openssh-cavsredhat-upgrade-openssh-clientsredhat-upgrade-openssh-debuginforedhat-upgrade-openssh-keycatredhat-upgrade-openssh-ldapredhat-upgrade-openssh-serverredhat-upgrade-openssh-server-sysvinitredhat-upgrade-pam_ssh_agent_auth | Aug 3, 2017 | Aug 7, 2016 |
| Suse | — | suse-upgrade-opensshsuse-upgrade-openssh-askpasssuse-upgrade-openssh-askpass-gnomesuse-upgrade-openssh-clientssuse-upgrade-openssh-commonsuse-upgrade-openssh-fipssuse-upgrade-openssh-helperssuse-upgrade-openssh-openssl1suse-upgrade-openssh-openssl1-helperssuse-upgrade-openssh-server | Sep 12, 2016 | Aug 7, 2016 |
| Ubuntu | ubuntu-upgrade-openssh-server | Aug 17, 2016 | Aug 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub