Multiple vulnerabilities have been found in OpenSSH, the worst of which could allow a remote attacker to gain unauthorized access.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 9.9_p2 | >= 9.9_p2 |
OpenSSH is a free application suite consisting of server and clients that replace tools like telnet, rlogin, rcp and ftp with more secure versions offering additional functionality.
Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-9.9_p2"
A vulnerability has been discovered in OpenSSH, which can lead to remote code execution with root privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 9.7_p1-r6 | >= 9.7_p1-r6 |
OpenSSH is a free application suite consisting of server and clients that replace tools like telnet, rlogin, rcp and ftp with more secure versions offering additional functionality.
A vulnerability has been discovered in OpenSSH. Please review the CVE identifier referenced below for details.
A critical vulnerability in sshd(8) was present in Portable OpenSSH versions that may allow arbitrary code execution with root privileges. Successful exploitation has been demonstrated on 32-bit Linux/glibc systems with ASLR. Under lab conditions, the attack requires on average 6-8 hours of continuous connections up to the maximum the server will accept. Exploitation on 64-bit systems is believed to be possible but has not been demonstrated at this time. It's likely that these attacks will be improved upon.
There is no known workaround at this time. Note that Gentoo has backported the fix to the following versions: net-misc/openssh-9.6_p1-r5 net-misc/openssh-9.7_p1-r6
All OpenSSH users should upgrade to the latest version and restart the sshd server (to ensure access for new sessions and no vulnerable code keeps running).
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-9.7_p1-r6"
With OpenRC:
# rc-service sshd restart
With systemd:
# systemctl try-restart sshd.service
Multiple vulnerabilities have been discovered in OpenSSH, the worst of which could lead to code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 9.6_p1 | >= 9.6_p1 |
OpenSSH is a free application suite consisting of server and clients that replace tools like telnet, rlogin, rcp and ftp with more secure versions offering additional functionality.
Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-9.6_p1"
Multiple vulnerbilities have been discovered in OpenSSH, the worst of which could result in remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 9.3_p2 | >= 9.3_p2 |
OpenSSH is a free application suite consisting of server and clients that replace tools like telnet, rlogin, rcp and ftp with more secure versions offering additional functionality.
Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details.
Please review the CVE identifiers referenced below for details.
CVE-2023-38408 can be worked around by avoiding connecting to untrusted servers with an SSH agent.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-9.3_p2"
Multiple vulnerabilities have been found in OpenSSH, the worst of which could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 9.1_p1 | >= 9.1_p1 |
OpenSSH is a free application suite consisting of server and clients that replace tools like telnet, rlogin, rcp and ftp with more secure versions offering additional functionality.
Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-9.1_p1"
Multiple vulnerabilities have been found in OpenSSH, the worst of which could allow a remote attacker to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 8.5_p1 | >= 8.5_p1 |
OpenSSH is a complete SSH protocol implementation that includes SFTP client and server support.
Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details.
A remote attacker, able to access the socket of the forwarding agent, might be able to execute arbitrary code with the privileges of the process or cause a Denial of Service condition. Furthermore, a remote attacker might conduct a man-in-the-middle attack targeting initial connection attempts where no host key for the server has been cached by client yet.
There is no known workaround at this time.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-8.5_p1"
An integer overflow in OpenSSH might allow an attacker to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | >= 8.0_p1-r2 | >= 8.0_p1-r4 |
OpenSSH is a complete SSH protocol implementation that includes SFTP client and server support.
OpenSSH, when built with “xmss” USE flag enabled, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key.
NOTE: This USE flag is disabled by default!
A remote attacker could connect to a vulnerable OpenSSH server using a special crafted XMSS key possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
Disable XMSS key type.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh/openssh-8.0_p1-r4"
Multiple vulnerabilities have been found in OpenSSH, the worst of which could allow a remote attacker to gain unauthorized access.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 7.9_p1-r4 | >= 7.9_p1-r4 |
OpenSSH is a complete SSH protocol implementation that includes SFTP client and server support.
Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details.
A remote attacker could overwrite arbitrary files, transfer malicious files, or gain unauthorized access.
There is no known workaround at this time.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-7.9_p1-r4"
A vulnerability in OpenSSH might allow remote attackers to determine valid usernames.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 7.7_p1-r8 | >= 7.7_p1-r8 |
OpenSSH is a complete SSH protocol implementation that includes SFTP client and server support.
It was discovered that OpenSSH was prone to a user enumeration vulnerability.
A remote attacker could conduct user enumeration.
There is no known workaround at this time.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-7.7_p1-r8"
A flaw has been discovered in OpenSSH which could allow a remote attacker to create zero-length files.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 7.5_p1-r3 | >= 7.5_p1-r3 |
OpenSSH is a complete SSH protocol implementation that includes SFTP client and server support.
The process_open function in sftp-server.c in OpenSSH did not properly prevent write operations in readonly mode.
A remote attacker could cause the creation of zero-length files.
There is no known workaround at this time.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-7.5_p1-r3"
Multiple vulnerabilities have been found in OpenSSH, the worst of which allows remote attackers to cause Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 7.3_p1-r7 | >= 7.3_p1-r7 |
OpenSSH is a complete SSH protocol implementation that includes SFTP client and server support.
Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details.
Remote attackers could cause Denial of Service and conduct user enumeration.
There is no known workaround at this time.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-7.3_p1-r7"
Multiple vulnerabilities have been found in OpenSSH, allowing attackers to leak client memory to a server, including private keys.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 7.1_p2 | >= 7.1_p2 |
OpenSSH is a complete SSH protocol implementation that includes SFTP client and server support.
Qualys have reported two issues in the “roaming” code included in the OpenSSH client, which provides undocumented, experimental support for resuming SSH connections. An OpenSSH client could be tricked into leaking parts of its memory to a malicious server. Furthermore, a buffer overflow can be exploited by a malicious server, but its exploitation requires non-default options and is mitigated due to another bug.
A remote attacker could entice a user to connect to a specially crafted OpenSSH server, possibly resulting in the disclosure of the user’s private keys. Users with private keys that are not protected by a passphrase are advised to generate new keys if they have connected to an SSH server they don’t fully trust.
Note that no special configuration is required to be vulnerable as the roaming feature is enabled by default on the client.
The issues can be worked around by disabling the roaming code. To do so, add “UseRoaming no” to the SSH client configuration, or specify “-o ‘UseRoaming no’” on the command line.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-7.1_p2"
Multiple vulnerabilities have been found in OpenSSH, the worst of which could lead to arbitrary code execution, or cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 7.1_p1-r2 | >= 7.1_p1-r2 |
OpenSSH is a complete SSH protocol implementation that includes an SFTP client and server support.
Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details.
There is no known workaround at this time.
All openssh users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-7.1_p1-r2"
Multiple vulnerabilities have been found in OpenSSH, the worst of which may allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 6.6_p1-r1 | >= 6.6_p1-r1 |
OpenSSH is a complete SSH protocol implementation that includes an SFTP client and server support.
Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details.
A remote attacker could execute arbitrary code, cause a Denial of Service condition, obtain sensitive information, or bypass environment restrictions.
There is no known workaround at this time.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-6.6_p1-r1"
NOTE: One or more of the issues described in this advisory have been fixed in previous updates. They are included in this advisory for the sake of completeness. It is likely that your system is already no longer affected by them.
Two flaws have been discovered in OpenSSH which could allow local attackers to escalate their privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 4.7_p1-r6 | >= 4.7_p1-r6 |
OpenSSH is a complete SSH protocol implementation that includes an SFTP client and server support.
Two issues have been discovered in OpenSSH:
A local attacker could exploit the first vulnerability to hijack forwarded X11 sessions of other users and possibly execute code with their privileges, disclose sensitive data or cause a Denial of Service, by binding a local X11 server to a port using only one address family. The second vulnerability might allow local attackers to bypass intended security restrictions and execute commands other than those specified by "ForceCommand" if they are able to write to their home directory.
There is no known workaround at this time.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-4.7_p1-r6"
A flaw has been discovered in OpenSSH which could allow a local attacker to bypass security restrictions.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 4.7 | >= 4.7 |
OpenSSH is a complete SSH protocol implementation that includes an SFTP client and server support.
Jan Pechanec discovered that OpenSSH uses a trusted X11 cookie when it cannot create an untrusted one.
An attacker could bypass the SSH client security policy and gain privileges by causing an X client to be treated as trusted.
There is no known workaround at this time.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-4.7"
Several Denial of Service vulnerabilities have been identified in OpenSSH.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 4.4_p1-r5 | >= 4.4_p1-r5 |
OpenSSH is a complete SSH protocol version 1.3, 1.5 and 2.0 implementation and includes sftp client and server support.
Tavis Ormandy of the Google Security Team has discovered a pre-authentication vulnerability, causing sshd to spin until the login grace time has been expired. Mark Dowd found an unsafe signal handler that was vulnerable to a race condition. It has also been discovered that when GSSAPI authentication is enabled, GSSAPI will in certain cases incorrectly abort.
The pre-authentication and signal handler vulnerabilities can cause a Denial of Service in OpenSSH. The vulnerability in the GSSAPI authentication abort could be used to determine the validity of usernames on some platforms.
There is no known workaround at this time.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-4.4_p1-r5"
A flaw in the OpenSSH daemon allows remote unauthenticated attackers to cause a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/openssh | * | < 4.3_p2-r5 | >= 4.3_p2-r5 |
OpenSSH is a free suite of applications for the SSH protocol, developed and maintained by the OpenBSD project.
Tavis Ormandy of the Google Security Team discovered a Denial of Service vulnerability in the SSH protocol version 1 CRC compensation attack detector.
A remote unauthenticated attacker may be able to trigger excessive CPU usage by sending a pathological SSH message, denying service to other legitimate users or processes.
The system administrator may disable SSH protocol version 1 in /etc/ssh/sshd_config.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-4.3_p2-r5"
A flaw in OpenSSH and Dropbear allows local users to elevate their privileges via scp.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/dropbear | * | < 0.47-r1 | >= 0.47-r1 |
| net-misc/openssh | * | < 4.2_p1-r1 | >= 4.2_p1-r1 |
OpenSSH is a free application suite consisting of server and clients that replace tools like telnet, rlogin, rcp and ftp with more secure versions offering additional functionality. Dropbear is an SSH server and client designed with a small memory footprint that includes OpenSSH scp code.
To copy from a local filesystem to another local filesystem, scp constructs a command line using 'cp' which is then executed via system(). Josh Bressers discovered that special characters are not escaped by scp, but are simply passed to the shell.
By tricking other users or applications to use scp on maliciously crafted filenames, a local attacker user can execute arbitrary commands with the rights of the user running scp.
There is no known workaround at this time.
All OpenSSH users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-4.2_p1-r1"
All Dropbear users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/dropbear-0.47-r1"