Debian OpenSSH vulnerabilities

CVE-2024-6387 [HIGH] CVE-2024-6387: openssh - A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd).... A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. Scope: local bookworm: resolved (fixed in 1:9.2p1-2+deb12u3) bullseye: resolved fork

CVE-2023-38408 [HIGH] CVE-2023-38408: openssh - The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently t... The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. Scope: local bookworm: resol

CVE-2023-48795 [MEDIUM] CVE-2023-48795: dropbear - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH bef... The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabl

CVE-2019-6111 [MEDIUM] CVE-2019-6111: openssh - An issue was discovered in OpenSSH 7.9. Due to the scp implementation being deri... An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrit

CVE-2018-20685 [MEDIUM] CVE-2018-20685: openssh - In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass inte... In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. Scope: local bookworm: resolved (fixed in 1:7.9p1-5) bullseye: resolved (fixed in 1:7.9p1-5) forky: resolved (fixed in 1:7.9p1-5) sid

CVE-2019-6109 [MEDIUM] CVE-2019-6109: openssh - An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the... An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c. Scope: local book

CVE-2023-25136 [MEDIUM] CVE-2023-25136: openssh - OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.... OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible

CVE-2007-4752 [HIGH] CVE-2007-4752: openssh - ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cann... ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted. Scope: local bookworm: resolved (fixed in 1:4.7p1-1) bullseye: resolved (fixed in 1:4.7p1-1) forky: resolved (fixed in

CVE-2016-6210 [MEDIUM] CVE-2016-6210: openssh - sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password has... sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided. Scope: local bookworm: resolved (fixed in 1:7.2p2-6) bullseye: reso

CVE-2018-15473 [MEDIUM] CVE-2018-15473: openssh - OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not dela... OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. Scope: local bookworm: resolved (fixed in 1:7.7p1-4) bullseye: resolved (fixed in 1:7.7p1-4) forky: resolv

CVE-2016-6515 [HIGH] CVE-2016-6515: openssh - The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does n... The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string. Scope: local bookworm: resolved (fixed in 1:7.3p1-1) bullseye: resolved (fixed in 1:7.3p1-1) forky: resolved (fixed in 1:7.3p1-1) sid

CVE-2016-10009 [HIGH] CVE-2016-10009: openssh - Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH befor... Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket. Scope: local bookworm: resolved (fixed in 1:7.4p1-1) bullseye: resolved (fixed in 1:7.4p1-1) forky: resolved (fixed in 1:7.4p1-1) sid: resolved (fixed in 1:7.4p1-

CVE-2008-0166 [HIGH] CVE-2008-0166: openssh - OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating system... OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys. Scope: local bookworm: resolved (fixed in 4.7p1-9) bullseye: resolved (fixed in 4.7p1-9) forky: resolved (fixe

CVE-2002-0640 [CRITICAL] CVE-2002-0640: openssh - Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers ... Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt). Scope: local bookworm: resolved (fixed in 1:3.4) bullseye: resolved (fixed in 1:3.

CVE-2016-3115 [MEDIUM] CVE-2016-3115: openssh - Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7... Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions. Scope: local bookworm: resolved (fixed in 1:7.2p2-1) bullseye: resolved (fixed in 1:7.2p2-1) forky:

CVE-2006-4924 [HIGH] CVE-2006-4924: openssh - sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote... sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not properly handled by the CRC compensation attack detector. Scope: local bookworm: resolved (fixed in 1:4.3p2-4) bullseye: resolved (fixed in 1:4.3p2-4) forky: resolved (f

CVE-2016-1908 [CRITICAL] CVE-2016-1908: openssh - The client in OpenSSH before 7.2 mishandles failed cookie generation for untrust... The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension

CVE-2003-0190 [MEDIUM] CVE-2003-0190: openssh - OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediat... OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack. Scope: local bookworm: resolved (fixed in 1:3.8.1p1-8.sarge.4) bullseye: resolved (fixed in 1:3.8.1p1-8.sarge.4) forky: resolved (fixed in 1:3.8.1p1-8.sa

CVE-2016-10010 [HIGH] CVE-2016-10010: openssh - sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwa... sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c. Scope: local bookworm: resolved (fixed in 1:7.4p1-1) bullseye: resolved (fixed in 1:7.4p1-1) forky: resolved (fixed in 1:7.4p1-1) sid: resolved (fixed in 1

CVE-2016-0777 [MEDIUM] CVE-2016-0777: openssh - The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x,... The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key. Scope: local bookworm: resolved (fixed in 1:7.1p2-1) bullseye: resolved (fixed in 1:7.1p2-1) forky: re