Vulnerabilites related to siemens - scalance_x204rna_ecc_firmware
cve-2003-0190
Vulnerability from cvelistv5
Published
2003-05-02 00:00
Modified
2024-08-08 01:43
Severity ?
EPSS score ?
Summary
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-08T01:43:36.108Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "RHSA-2003:222", tags: [ "vendor-advisory", "x_transferred", ], url: "http://www.redhat.com/support/errata/RHSA-2003-222.html", }, { name: "20030430 OpenSSH/PAM timing attack allows remote users identification", tags: [ "mailing-list", "x_transferred", ], url: "http://marc.info/?l=bugtraq&m=105172058404810&w=2", }, { name: "7467", tags: [ "vdb-entry", "x_transferred", ], url: "http://www.securityfocus.com/bid/7467", }, { name: "20030806 [OpenPKG-SA-2003.035] OpenPKG Security Advisory (openssh)", tags: [ "mailing-list", "x_transferred", ], url: "http://marc.info/?l=bugtraq&m=106018677302607&w=2", }, { name: "RHSA-2003:224", tags: [ "vendor-advisory", "x_transferred", ], url: "http://www.redhat.com/support/errata/RHSA-2003-224.html", }, { name: "oval:org.mitre.oval:def:445", tags: [ "vdb-entry", "signature", "x_transferred", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A445", }, { tags: [ "x_transferred", ], url: "http://lab.mediaservice.net/advisory/2003-01-openssh.txt", }, { name: "TLSA-2003-31", tags: [ "vendor-advisory", "x_transferred", ], url: "http://www.turbolinux.com/security/TLSA-2003-31.txt", }, { name: "20030430 OpenSSH/PAM timing attack allows remote users identification", tags: [ "mailing-list", "x_transferred", ], url: "http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004815.html", }, { tags: [ "x_transferred", ], url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2003-04-30T00:00:00", descriptions: [ { lang: "en", value: "OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2022-12-13T00:00:00", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { name: "RHSA-2003:222", tags: [ "vendor-advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2003-222.html", }, { name: "20030430 OpenSSH/PAM timing attack allows remote users identification", tags: [ "mailing-list", ], url: "http://marc.info/?l=bugtraq&m=105172058404810&w=2", }, { name: "7467", tags: [ "vdb-entry", ], url: "http://www.securityfocus.com/bid/7467", }, { name: "20030806 [OpenPKG-SA-2003.035] OpenPKG Security Advisory (openssh)", tags: [ "mailing-list", ], url: "http://marc.info/?l=bugtraq&m=106018677302607&w=2", }, { name: "RHSA-2003:224", tags: [ "vendor-advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2003-224.html", }, { name: "oval:org.mitre.oval:def:445", tags: [ "vdb-entry", "signature", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A445", }, { url: "http://lab.mediaservice.net/advisory/2003-01-openssh.txt", }, { name: "TLSA-2003-31", tags: [ "vendor-advisory", ], url: "http://www.turbolinux.com/security/TLSA-2003-31.txt", }, { name: "20030430 OpenSSH/PAM timing attack allows remote users identification", tags: [ "mailing-list", ], url: "http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004815.html", }, { url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf", }, ], }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2003-0190", datePublished: "2003-05-02T00:00:00", dateReserved: "2003-04-01T00:00:00", dateUpdated: "2024-08-08T01:43:36.108Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2019-16905
Vulnerability from cvelistv5
Published
2019-10-09 00:00
Modified
2024-08-05 01:24
Severity ?
EPSS score ?
Summary
OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T01:24:48.454Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://www.openssh.com/releasenotes.html", }, { tags: [ "x_transferred", ], url: "https://www.openwall.com/lists/oss-security/2019/10/09/1", }, { tags: [ "x_transferred", ], url: "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c.diff?r1=1.5&r2=1.6&f=h", }, { tags: [ "x_transferred", ], url: "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c", }, { tags: [ "x_transferred", ], url: "https://bugzilla.suse.com/show_bug.cgi?id=1153537", }, { tags: [ "x_transferred", ], url: "https://0day.life/exploits/0day-1009.html", }, { tags: [ "x_transferred", ], url: "https://ssd-disclosure.com/archives/4033/ssd-advisory-openssh-pre-auth-xmss-integer-overflow", }, { tags: [ "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20191024-0003/", }, { name: "GLSA-201911-01", tags: [ "vendor-advisory", "x_transferred", ], url: "https://security.gentoo.org/glsa/201911-01", }, { tags: [ "x_transferred", ], url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], descriptions: [ { lang: "en", value: "OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2022-12-13T00:00:00", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { url: "https://www.openssh.com/releasenotes.html", }, { url: "https://www.openwall.com/lists/oss-security/2019/10/09/1", }, { url: "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c.diff?r1=1.5&r2=1.6&f=h", }, { url: "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c", }, { url: "https://bugzilla.suse.com/show_bug.cgi?id=1153537", }, { url: "https://0day.life/exploits/0day-1009.html", }, { url: "https://ssd-disclosure.com/archives/4033/ssd-advisory-openssh-pre-auth-xmss-integer-overflow", }, { url: "https://security.netapp.com/advisory/ntap-20191024-0003/", }, { name: "GLSA-201911-01", tags: [ "vendor-advisory", ], url: "https://security.gentoo.org/glsa/201911-01", }, { url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf", }, ], }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2019-16905", datePublished: "2019-10-09T00:00:00", dateReserved: "2019-09-26T00:00:00", dateUpdated: "2024-08-05T01:24:48.454Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
Vulnerability from fkie_nvd
Published
2003-05-12 04:00
Modified
2025-04-03 01:03
Severity ?
Summary
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openbsd | openssh | * | |
| openbsd | openssh | 3.6.1 | |
| openpkg | openpkg | 1.2 | |
| openpkg | openpkg | 1.3 | |
| siemens | scalance_x204rna_ecc_firmware | * | |
| siemens | scalance_x204rna_ecc | - | |
| siemens | scalance_x204rna_firmware | * | |
| siemens | scalance_x204rna | - |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*", matchCriteriaId: "F0420843-E456-48A7-B46F-823090565FBC", versionEndExcluding: "3.6.1", vulnerable: true, }, { criteria: "cpe:2.3:a:openbsd:openssh:3.6.1:p1:*:*:*:*:*:*", matchCriteriaId: "5510F5B6-6505-4656-A3C0-1E8425B0D39D", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:openpkg:openpkg:1.2:*:*:*:*:*:*:*", matchCriteriaId: "B6ADD463-E918-4F4D-9FA7-D109EBC98BD8", vulnerable: true, }, { criteria: "cpe:2.3:a:openpkg:openpkg:1.3:*:*:*:*:*:*:*", matchCriteriaId: "46B96764-9241-4586-9FA5-77D8D8EBE3BD", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:siemens:scalance_x204rna_ecc_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "0F4927F0-F350-431B-9762-009DC7660588", versionEndExcluding: "3.2.7", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:siemens:scalance_x204rna_ecc:-:*:*:*:*:*:*:*", matchCriteriaId: "230B1F1A-8D69-4C66-8046-7D1DE3BEFEA1", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "0D3A0312-1249-4257-98F1-57E8959989C5", versionEndExcluding: "3.2.7", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:*", matchCriteriaId: "EA8B483F-0FD2-49F8-A86A-672A6E007949", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.", }, { lang: "es", value: "OpenSSH-portable (OpenSSH) 3.6.1p1 y anteriores con soporte PAM activado envía inmediatamente un mensaje de error cuando un usuario no existe, lo que permite a atacantes remotos determinar nombres de usuario válidos mediante un ataque de temporización.", }, ], id: "CVE-2003-0190", lastModified: "2025-04-03T01:03:51.193", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 5, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 10, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], }, published: "2003-05-12T04:00:00.000", references: [ { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://lab.mediaservice.net/advisory/2003-01-openssh.txt", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004815.html", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://marc.info/?l=bugtraq&m=105172058404810&w=2", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://marc.info/?l=bugtraq&m=106018677302607&w=2", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://www.redhat.com/support/errata/RHSA-2003-222.html", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://www.redhat.com/support/errata/RHSA-2003-224.html", }, { source: "cve@mitre.org", tags: [ "Broken Link", "Exploit", "Patch", "Third Party Advisory", "VDB Entry", "Vendor Advisory", ], url: "http://www.securityfocus.com/bid/7467", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://www.turbolinux.com/security/TLSA-2003-31.txt", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A445", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://lab.mediaservice.net/advisory/2003-01-openssh.txt", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004815.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://marc.info/?l=bugtraq&m=105172058404810&w=2", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://marc.info/?l=bugtraq&m=106018677302607&w=2", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://www.redhat.com/support/errata/RHSA-2003-222.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://www.redhat.com/support/errata/RHSA-2003-224.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", "Exploit", "Patch", "Third Party Advisory", "VDB Entry", "Vendor Advisory", ], url: "http://www.securityfocus.com/bid/7467", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://www.turbolinux.com/security/TLSA-2003-31.txt", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A445", }, ], sourceIdentifier: "cve@mitre.org", vulnStatus: "Deferred", weaknesses: [ { description: [ { lang: "en", value: "CWE-203", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Vulnerability from fkie_nvd
Published
2019-10-09 20:15
Modified
2024-11-21 04:31
Severity ?
Summary
OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openbsd | openssh | * | |
| openbsd | openssh | * | |
| netapp | cloud_backup | - | |
| netapp | steelstore_cloud_integrated_storage | - | |
| siemens | scalance_x204rna_firmware | * | |
| siemens | scalance_x204rna | - | |
| siemens | scalance_x204rna_ecc_firmware | * | |
| siemens | scalance_x204rna_ecc | - |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*", matchCriteriaId: "4419F9A7-C91A-49F3-8424-0FC679147627", versionEndIncluding: "7.9", versionStartIncluding: "7.7", vulnerable: true, }, { criteria: "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*", matchCriteriaId: "7EDB383B-BB44-4FEA-917B-1BA5279DB478", versionEndExcluding: "8.1", versionStartIncluding: "8.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*", matchCriteriaId: "5C2089EE-5D7F-47EC-8EA5-0F69790564C4", vulnerable: true, }, { criteria: "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*", matchCriteriaId: "E94F7F59-1785-493F-91A7-5F5EA5E87E4D", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "0D3A0312-1249-4257-98F1-57E8959989C5", versionEndExcluding: "3.2.7", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:*", matchCriteriaId: "EA8B483F-0FD2-49F8-A86A-672A6E007949", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:siemens:scalance_x204rna_ecc_firmware:*:*:*:*:*:*:*:*", matchCriteriaId: "0F4927F0-F350-431B-9762-009DC7660588", versionEndExcluding: "3.2.7", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:siemens:scalance_x204rna_ecc:-:*:*:*:*:*:*:*", matchCriteriaId: "230B1F1A-8D69-4C66-8046-7D1DE3BEFEA1", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.", }, { lang: "es", value: "OpenSSH 7.7 a 7.9 y 8.x anterior de la versión 8.1, cuando se compila con un tipo de clave experimental, tiene un desbordamiento de entero de identificación previa si un cliente o servidor está configurado para usar una clave XMSS especialmente diseñada. Esto conduce a la corrupción de la memoria y la ejecución del código local debido a un error en el algoritmo de análisis de claves XMSS. NOTA: la implementación de XMSS se considera experimental en todas las versiones de OpenSSH lanzadas, y no hay una forma compatible para habilitarla al crear OpenSSH portátil.", }, ], id: "CVE-2019-16905", lastModified: "2024-11-21T04:31:18.910", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "LOCAL", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 4.4, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:L/AC:M/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 3.4, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 1.8, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2019-10-09T20:15:23.503", references: [ { source: "cve@mitre.org", tags: [ "Exploit", "Third Party Advisory", ], url: "https://0day.life/exploits/0day-1009.html", }, { source: "cve@mitre.org", tags: [ "Issue Tracking", "Third Party Advisory", ], url: "https://bugzilla.suse.com/show_bug.cgi?id=1153537", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf", }, { source: "cve@mitre.org", tags: [ "Release Notes", "Vendor Advisory", ], url: "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c", }, { source: "cve@mitre.org", tags: [ "Patch", ], url: "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c.diff?r1=1.5&r2=1.6&f=h", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "https://security.gentoo.org/glsa/201911-01", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "https://security.netapp.com/advisory/ntap-20191024-0003/", }, { source: "cve@mitre.org", tags: [ "Exploit", "Third Party Advisory", ], url: "https://ssd-disclosure.com/archives/4033/ssd-advisory-openssh-pre-auth-xmss-integer-overflow", }, { source: "cve@mitre.org", tags: [ "Release Notes", ], url: "https://www.openssh.com/releasenotes.html", }, { source: "cve@mitre.org", tags: [ "Mailing List", "Third Party Advisory", ], url: "https://www.openwall.com/lists/oss-security/2019/10/09/1", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Exploit", "Third Party Advisory", ], url: "https://0day.life/exploits/0day-1009.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Third Party Advisory", ], url: "https://bugzilla.suse.com/show_bug.cgi?id=1153537", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Release Notes", "Vendor Advisory", ], url: "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", ], url: "https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c.diff?r1=1.5&r2=1.6&f=h", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://security.gentoo.org/glsa/201911-01", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://security.netapp.com/advisory/ntap-20191024-0003/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Exploit", "Third Party Advisory", ], url: "https://ssd-disclosure.com/archives/4033/ssd-advisory-openssh-pre-auth-xmss-integer-overflow", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Release Notes", ], url: "https://www.openssh.com/releasenotes.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Mailing List", "Third Party Advisory", ], url: "https://www.openwall.com/lists/oss-security/2019/10/09/1", }, ], sourceIdentifier: "cve@mitre.org", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-190", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }