ghsa-84j4-ccmw-hwpg
Vulnerability from github
Published
2022-05-24 19:14
Modified
2024-03-21 03:34
Severity
Details
OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session.
{
"affected": [],
"aliases": [
"CVE-2016-20012"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-15T20:15:00Z",
"severity": "MODERATE"
},
"details": "OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session.",
"id": "GHSA-84j4-ccmw-hwpg",
"modified": "2024-03-21T03:34:06Z",
"published": "2022-05-24T19:14:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-20012"
},
{
"type": "WEB",
"url": "https://github.com/openssh/openssh-portable/pull/270"
},
{
"type": "WEB",
"url": "https://github.com/openssh/openssh-portable/pull/270#issuecomment-920577097"
},
{
"type": "WEB",
"url": "https://github.com/openssh/openssh-portable/pull/270#issuecomment-943909185"
},
{
"type": "WEB",
"url": "https://github.com/openssh/openssh-portable/blob/d0fffc88c8fe90c1815c6f4097bc8cbcabc0f3dd/auth2-pubkey.c#L261-L265"
},
{
"type": "WEB",
"url": "https://rushter.com/blog/public-ssh-keys"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20211014-0005"
},
{
"type": "WEB",
"url": "https://utcc.utoronto.ca/~cks/space/blog/tech/SSHKeysAreInfoLeak"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2018/08/24/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Loading...