OP
Product
OpenSSH
150
CVEs
0
On KEV
9.8
Max CVSS
11
New 30D
Severity mix
Critical 7High 30Medium 37Low 14
Watch
Add OpenSSH to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2008-1483 | – | Mar 24 | OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on… Affected: 4.3p2 |
| CVE-2007-3102 | – | Oct 18 | Unspecified vulnerability in the linux_audit_record_event function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write… Affected: 4.3p2 |
| CVE-2007-4752 | – | Sep 12 | ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended… Affected: through 4.6; 4.0; 4.0p1; 4.1; 4.1p1; 4.2; +7 more |
| CVE-2007-4654 | – | Sep 4 | Unspecified vulnerability in SSHield 1.6.1 with OpenSSH 3.0.2p1 on Cisco WebNS 8.20.0.1 on Cisco Content Services Switch (CSS) series 11000 devices allows remote attackers to… Affected: 3.0.2p1 |
| CVE-2007-2768 | – | May 21 | OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different… Affected: All versions, or not specified |
| CVE-2007-2243 | – | Apr 25 | OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via… Affected: 1.2; 1.2.1; 1.2.2; 1.2.3; 1.2.27; 2.1; +34 more |
| CVE-2006-5794 | – | Nov 8 | Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker verification that authentication has been successful, which might allow… Affected: through 4.4 |
| CVE-2006-5229 | – | Oct 10 | OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via… Affected: 4.1 |
| CVE-2006-4925 | – | Sep 29 | packet.c in ssh in OpenSSH allows remote attackers to cause a denial of service (crash) by sending an invalid protocol sequence with USERAUTH_SUCCESS before NEWKEYS, which causes… Affected: 4.5 |
| CVE-2006-5052 | – | Sep 27 | Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors… Affected: 1.2; 1.2.1; 1.2.2; 1.2.3; 1.2.27; 2.1; +34 more |
| CVE-2006-4924 | – | Sep 27 | sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service (CPU consumption) via an SSH packet that contains duplicate… Affected: 1.2; 1.2.1; 1.2.2; 1.2.3; 1.2.27; 2.1; +34 more |
| CVE-2006-0883 | – | Mar 7 | OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows remote attackers to… Affected: 3.8.1p1 |
| CVE-2006-0225 | – | Jan 25 | scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice Affected: 3.0; 3.0.1; 3.0.1p1; 3.0.2; 3.0.2p1; 3.0p1; +27 more |
| CVE-2005-2797 | – | Sep 6 | OpenSSH 4.0, and other versions before 4.2, does not properly handle dynamic port forwarding ("-D" option) when a listen address is not provided, which may cause OpenSSH to enable… Affected: 4.0 |
| CVE-2005-2798 | – | Sep 6 | sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, allows GSSAPI credentials to be delegated to clients who log in using non-GSSAPI methods, which could cause… Affected: 3.0; 3.0.1; 3.0.1p1; 3.0.2; 3.0.2p1; 3.0p1; +26 more |
| CVE-2005-2666 | – | Aug 23 | SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier… Affected: 3.0; 3.0.1; 3.0.1p1; 3.0.2; 3.0.2p1; 3.0p1; +24 more |
| CVE-2004-2760 | – | Dec 31 | sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open… Affected: 3.5; 3.5p1 |
| CVE-2004-2069 | – | Dec 31 | sshd.c in OpenSSH 3.6.1p2 and 3.7.1p2 and possibly other versions, when using privilege separation, does not properly signal the non-privileged process when a session has been… Affected: 3.6.1p2; 3.7.1p2 |
| CVE-2004-1653 | – | Aug 31 | The default configuration for OpenSSH enables AllowTcpForwarding, which could allow remote authenticated users to perform a port bounce, when configured with an anonymous access… Affected: through 3.9 |
| CVE-2004-0175 | – | Aug 18 | Directory traversal vulnerability in scp for OpenSSH before 3.4p1 allows remote malicious servers to overwrite arbitrary files Affected: 3.0; 3.0.1; 3.0.1p1; 3.0.2; 3.0.2p1; 3.0p1; +9 more |
| CVE-2003-1562 | – | Dec 31 | sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with… Affected: 1.2; 1.2.1; 1.2.2; 1.2.3; 1.2.27; 1.3; +34 more |
| CVE-2003-0786 | – | Nov 17 | The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which… Affected: 3.7.1; 3.7.1p1 |
| CVE-2003-0787 | – | Nov 17 | The PAM conversation function in OpenSSH 3.7.1 and 3.7.1p1 interprets an array of structures as an array of pointers, which allows attackers to modify the stack and possibly gain… Affected: 3.7.1; 3.7.1p1 |
| CVE-2003-0682 | – | Oct 6 | "Memory bugs" in OpenSSH 3.7.1 and earlier, with unknown impact, a different set of vulnerabilities than CVE-2003-0693 and CVE-2003-0695 Affected: through 3.7.1 |
| CVE-2003-0695 | – | Oct 6 | Multiple "buffer management errors" in OpenSSH before 3.7.1 may allow attackers to cause a denial of service or execute arbitrary code using (1) buffer_init in buffer.c, (2)… Affected: through 3.7.1 |
| CVE-2003-0693 | – | Sep 22 | A "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory… Affected: through 3.7 |
| CVE-2003-0386 | – | Jul 2 | OpenSSH 3.6.1 and earlier, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass "from=" and "user@host"… Affected: 3.6.1 |
| CVE-2003-0190 | – | May 12 | OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine… Affected: before 3.6.1; 3.6.1 |
| CVE-2002-0765 | – | Aug 12 | sshd in OpenSSH 3.2.2, when using YP with netgroups and under certain conditions, may allow users to successfully authenticate and log in with another user's password Affected: 3.2.2 |
| CVE-2002-0640 | – | Jul 3 | Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication… Affected: 1.2.2; 1.2.3; 2.1; 2.1.1; 2.2; 2.3; +20 more |
| CVE-2002-0575 | – | Jun 18 | Buffer overflow in OpenSSH before 2.9.9, and 3.x before 3.2.1, with Kerberos/AFS support and KerberosTgtPassing or AFSTokenPassing enabled, allows remote and local authenticated… Affected: 2.1; 2.1.1; 2.2; 2.3; 2.5; 2.5.1; +10 more |
| CVE-2001-1507 | – | Dec 31 | OpenSSH before 3.0.1 with Kerberos V enabled does not properly authenticate users, which could allow remote attackers to login unchallenged Affected: 3.0; 3.0p1 |
| CVE-2001-1585 | – | Dec 31 | SSH protocol 2 (aka SSH-2) public key authentication in the development snapshot of OpenSSH 2.3.1, available from 2001-01-18 through 2001-02-08, does not perform a… Affected: 2.3.1 |
| CVE-2001-0872 | – | Dec 21 | OpenSSH 3.0.1 and earlier with UseLogin enabled does not properly cleanse critical environment variables such as LD_PRELOAD, which allows local users to gain root privileges Affected: through 3.0.1 |
| CVE-2001-0816 | – | Dec 6 | OpenSSH before 2.9.9, when running sftp using sftp-server and using restricted keypairs, allows remote authenticated users to bypass authorized_keys2 command= restrictions using… Affected: through 2.9.9 |
| CVE-2001-1380 | – | Oct 18 | OpenSSH before 2.9.9, while using keypairs and multiple keys of different types in the ~/.ssh/authorized_keys2 file, may not properly handle the "from" option associated with a… Affected: through 2.9.9 |
| CVE-2001-1382 | – | Sep 27 | The "echo simulation" traffic analysis countermeasure in OpenSSH before 2.9.9p2 sends an additional echo packet after the password and carriage return is entered, which could… Affected: through 2.9.9p2 |
| CVE-2001-1029 | – | Sep 20 | libutil in OpenSSH on FreeBSD 4.4 and earlier does not drop privileges before verifying the capabilities for reading the copyright and welcome files, which allows local users to… Affected: 4.5 |
| CVE-2001-0572 | – | Aug 22 | The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information… Affected: 4.5 |
| CVE-2001-0529 | – | Aug 14 | OpenSSH version 2.9 and earlier, with X forwarding enabled, allows a local attacker to delete any file named 'cookies' via a symlink attack Affected: through 2.9 |
| CVE-2001-0361 | – | Jun 27 | Implementations of SSH version 1.5, including (1) OpenSSH up to version 2.3.0, (2) AppGate, and (3) ssh-1 up to version 1.2.31, in certain configurations, allow a remote attacker… Affected: 1.2.3; 2.1; 2.1.1 |
| CVE-2001-1459 | – | Jun 19 | OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module (PAM) session if commands are executed with no pty, which allows local users to bypass resource limits… Affected: 2.1; 2.1.1; 2.2; 2.3; 2.5; 2.5.1; +2 more |
| CVE-2001-0144 | – | Mar 12 | CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to execute arbitrary commands on an SSH server or client via an integer overflow Affected: 1.2.2; 1.2.3; 2.1; 2.1.1; 2.2 |
| CVE-2000-1169 | – | Jan 9 | OpenSSH SSH client before 2.3.0 does not properly disable X11 or agent forwarding, which could allow a malicious SSH server to gain access to the X11 display and sniff X11 events,… Affected: 2.2 |
| CVE-2000-0992 | – | Dec 19 | Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote malicious scp server to overwrite arbitrary files via a Affected: 1.2; 1.2.3 |
| CVE-2000-0999 | – | Dec 11 | Format string vulnerabilities in OpenBSD ssh program (and possibly other BSD-based operating systems) allow attackers to gain root privileges Affected: 4.5 |
| CVE-2000-0525 | – | Jun 8 | OpenSSH does not properly drop privileges when the UseLogin option is enabled, which allows local users to execute arbitrary commands by providing the command to the ssh daemon Affected: 1.2; 1.2.3; 2.1 |
| CVE-2000-0217 | – | Feb 24 | The default configuration of SSH allows X forwarding, which could allow a remote attacker to control a client's X sessions via a malicious xauth program Affected: 1.2 |
| CVE-2000-0143 | – | Feb 11 | The SSH protocol server sshd allows local users without shell access to redirect a TCP connection through a service that uses the standard system password database for… Affected: through 1.2.1; 1.2 |
| CVE-1999-1010 | – | Dec 14 | An SSH 1.2.27 server allows a client to use the "none" cipher, even if it is not allowed by the server policy Affected: 1.2.27 |