Openbsd OpenSSH vulnerabilities

CVE-2005-2797 [MEDIUM] CVE-2005-2797: OpenSSH 4.0, and other versions before 4.2, does not properly handle dynamic port forwarding ("-D" o OpenSSH 4.0, and other versions before 4.2, does not properly handle dynamic port forwarding ("-D" option) when a listen address is not provided, which may cause OpenSSH to enable the GatewayPorts functionality.

CVE-2001-0529 [HIGH] CVE-2001-0529: OpenSSH version 2.9 and earlier, with X forwarding enabled, allows a local attacker to delete any fi OpenSSH version 2.9 and earlier, with X forwarding enabled, allows a local attacker to delete any file named 'cookies' via a symlink attack.

CVE-2025-61984 [LOW] CWE-159 CVE-2025-61984: ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possib ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not c

CVE-2008-1483 [MEDIUM] CWE-264 CVE-2008-1483: OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by Emacs.

CVE-2025-32728 [LOW] CWE-440 CVE-2025-32728: In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.

CVE-2000-0217 [MEDIUM] CVE-2000-0217: The default configuration of SSH allows X forwarding, which could allow a remote attacker to control The default configuration of SSH allows X forwarding, which could allow a remote attacker to control a client's X sessions via a malicious xauth program.

CVE-2011-5000 [LOW] CWE-189 CVE-2011-5000: The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic a The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field. NOTE: there may be limited scenarios in which this issue is relevant.

CVE-2025-61985 [LOW] CWE-158 CVE-2025-61985: ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code e ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.

CVE-2026-73281 [LOW] CWE-669 CVE-2026-73281: In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur o In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension.

CVE-2001-0361 [MEDIUM] CWE-310 CVE-2001-0361: Implementations of SSH version 1.5, including (1) OpenSSH up to version 2.3.0, (2) AppGate, and (3) Implementations of SSH version 1.5, including (1) OpenSSH up to version 2.3.0, (2) AppGate, and (3) ssh-1 up to version 1.2.31, in certain configurations, allow a remote attacker to decrypt and/or alter traffic via a "Bleichenbacher attack" on PKCS#1 version 1.5.

CVE-2005-2666 [LOW] CWE-255 CVE-2005-2666: SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP a SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.

CVE-2026-73283 [LOW] CWE-670 CVE-2026-73283: In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applica In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

CVE-2000-0143 [MEDIUM] CVE-2000-0143: The SSH protocol server sshd allows local users without shell access to redirect a TCP connection th The SSH protocol server sshd allows local users without shell access to redirect a TCP connection through a service that uses the standard system password database for authentication, such as POP or FTP.

CVE-2026-35388 [LOW] CWE-420 CVE-2026-35388: OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions. OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

CVE-1999-1010 [LOW] CVE-1999-1010: An SSH 1.2.27 server allows a client to use the "none" cipher, even if it is not allowed by the serv An SSH 1.2.27 server allows a client to use the "none" cipher, even if it is not allowed by the server policy.

CVE-2008-3259 [LOW] CWE-200 CVE-2008-3259: OpenSSH before 5.1 sets the SO_REUSEADDR socket option when the X11UseLocalhost configuration settin OpenSSH before 5.1 sets the SO_REUSEADDR socket option when the X11UseLocalhost configuration setting is disabled, which allows local users on some platforms to hijack the X11 forwarding port via a bind to a single IP address, as demonstrated on the HP-UX platform.