OpenSSH
by OpenBSD
Source repositories
CVEs (136)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2003-0386 | 0.00 | — | 0.06 | Jul 2, 2003 | OpenSSH 3.6.1 and earlier, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass "from=" and "user@host" address restrictions by connecting to a host from a system whose reverse DNS hostname contains the… | |||
| CVE-2002-0765 | 0.00 | — | 0.01 | Aug 12, 2002 | sshd in OpenSSH 3.2.2, when using YP with netgroups and under certain conditions, may allow users to successfully authenticate and log in with another user's password. | |||
| CVE-2002-0640 | 0.00 | — | 0.27 | Jul 3, 2002 | Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication… | |||
| CVE-2001-1507 | 0.00 | — | 0.02 | Dec 31, 2001 | OpenSSH before 3.0.1 with Kerberos V enabled does not properly authenticate users, which could allow remote attackers to login unchallenged. | |||
| CVE-2001-1585 | 0.00 | — | 0.02 | Dec 31, 2001 | SSH protocol 2 (aka SSH-2) public key authentication in the development snapshot of OpenSSH 2.3.1, available from 2001-01-18 through 2001-02-08, does not perform a challenge-response step to ensure that the client has the proper private key, which allows remote attackers to… | |||
| CVE-2001-0872 | 0.00 | — | 0.01 | Dec 21, 2001 | OpenSSH 3.0.1 and earlier with UseLogin enabled does not properly cleanse critical environment variables such as LD_PRELOAD, which allows local users to gain root privileges. | |||
| CVE-2001-0816 | 0.00 | — | 0.02 | Dec 6, 2001 | OpenSSH before 2.9.9, when running sftp using sftp-server and using restricted keypairs, allows remote authenticated users to bypass authorized_keys2 command= restrictions using sftp commands. | |||
| CVE-2001-1380 | 0.00 | — | 0.03 | Oct 18, 2001 | OpenSSH before 2.9.9, while using keypairs and multiple keys of different types in the ~/.ssh/authorized_keys2 file, may not properly handle the "from" option associated with a key, which could allow remote attackers to login from unauthorized IP addresses. | |||
| CVE-2001-0529 | 0.00 | — | 0.01 | Aug 14, 2001 | OpenSSH version 2.9 and earlier, with X forwarding enabled, allows a local attacker to delete any file named 'cookies' via a symlink attack. | |||
| CVE-2001-0361 | 0.00 | — | 0.03 | Jun 27, 2001 | Implementations of SSH version 1.5, including (1) OpenSSH up to version 2.3.0, (2) AppGate, and (3) ssh-1 up to version 1.2.31, in certain configurations, allow a remote attacker to decrypt and/or alter traffic via a "Bleichenbacher attack" on PKCS#1 version 1.5. | |||
| CVE-2001-1459 | 0.00 | — | 0.02 | Jun 19, 2001 | OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module (PAM) session if commands are executed with no pty, which allows local users to bypass resource limits (rlimits) set in pam.d. | |||
| CVE-2000-1169 | 0.00 | — | 0.02 | Jan 9, 2001 | OpenSSH SSH client before 2.3.0 does not properly disable X11 or agent forwarding, which could allow a malicious SSH server to gain access to the X11 display and sniff X11 events, or gain access to the ssh-agent. | |||
| CVE-2000-0525 | 0.00 | — | 0.03 | Jun 8, 2000 | OpenSSH does not properly drop privileges when the UseLogin option is enabled, which allows local users to execute arbitrary commands by providing the command to the ssh daemon. | |||
| CVE-2000-0217 | 0.00 | — | 0.01 | Feb 24, 2000 | The default configuration of SSH allows X forwarding, which could allow a remote attacker to control a client's X sessions via a malicious xauth program. | |||
| CVE-2000-0143 | 0.00 | — | 0.00 | Feb 11, 2000 | The SSH protocol server sshd allows local users without shell access to redirect a TCP connection through a service that uses the standard system password database for authentication, such as POP or FTP. | |||
| CVE-1999-1010 | 0.00 | — | 0.01 | Dec 14, 1999 | An SSH 1.2.27 server allows a client to use the "none" cipher, even if it is not allowed by the server policy. |
- CVE-2003-0386Jul 2, 2003risk 0.00cvss —epss 0.06
OpenSSH 3.6.1 and earlier, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass "from=" and "user@host" address restrictions by connecting to a host from a system whose reverse DNS hostname contains the…
- CVE-2002-0765Aug 12, 2002risk 0.00cvss —epss 0.01
sshd in OpenSSH 3.2.2, when using YP with netgroups and under certain conditions, may allow users to successfully authenticate and log in with another user's password.
- CVE-2002-0640Jul 3, 2002risk 0.00cvss —epss 0.27
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication…
- CVE-2001-1507Dec 31, 2001risk 0.00cvss —epss 0.02
OpenSSH before 3.0.1 with Kerberos V enabled does not properly authenticate users, which could allow remote attackers to login unchallenged.
- CVE-2001-1585Dec 31, 2001risk 0.00cvss —epss 0.02
SSH protocol 2 (aka SSH-2) public key authentication in the development snapshot of OpenSSH 2.3.1, available from 2001-01-18 through 2001-02-08, does not perform a challenge-response step to ensure that the client has the proper private key, which allows remote attackers to…
- CVE-2001-0872Dec 21, 2001risk 0.00cvss —epss 0.01
OpenSSH 3.0.1 and earlier with UseLogin enabled does not properly cleanse critical environment variables such as LD_PRELOAD, which allows local users to gain root privileges.
- CVE-2001-0816Dec 6, 2001risk 0.00cvss —epss 0.02
OpenSSH before 2.9.9, when running sftp using sftp-server and using restricted keypairs, allows remote authenticated users to bypass authorized_keys2 command= restrictions using sftp commands.
- CVE-2001-1380Oct 18, 2001risk 0.00cvss —epss 0.03
OpenSSH before 2.9.9, while using keypairs and multiple keys of different types in the ~/.ssh/authorized_keys2 file, may not properly handle the "from" option associated with a key, which could allow remote attackers to login from unauthorized IP addresses.
- CVE-2001-0529Aug 14, 2001risk 0.00cvss —epss 0.01
OpenSSH version 2.9 and earlier, with X forwarding enabled, allows a local attacker to delete any file named 'cookies' via a symlink attack.
- CVE-2001-0361Jun 27, 2001risk 0.00cvss —epss 0.03
Implementations of SSH version 1.5, including (1) OpenSSH up to version 2.3.0, (2) AppGate, and (3) ssh-1 up to version 1.2.31, in certain configurations, allow a remote attacker to decrypt and/or alter traffic via a "Bleichenbacher attack" on PKCS#1 version 1.5.
- CVE-2001-1459Jun 19, 2001risk 0.00cvss —epss 0.02
OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module (PAM) session if commands are executed with no pty, which allows local users to bypass resource limits (rlimits) set in pam.d.
- CVE-2000-1169Jan 9, 2001risk 0.00cvss —epss 0.02
OpenSSH SSH client before 2.3.0 does not properly disable X11 or agent forwarding, which could allow a malicious SSH server to gain access to the X11 display and sniff X11 events, or gain access to the ssh-agent.
- CVE-2000-0525Jun 8, 2000risk 0.00cvss —epss 0.03
OpenSSH does not properly drop privileges when the UseLogin option is enabled, which allows local users to execute arbitrary commands by providing the command to the ssh daemon.
- CVE-2000-0217Feb 24, 2000risk 0.00cvss —epss 0.01
The default configuration of SSH allows X forwarding, which could allow a remote attacker to control a client's X sessions via a malicious xauth program.
- CVE-2000-0143Feb 11, 2000risk 0.00cvss —epss 0.00
The SSH protocol server sshd allows local users without shell access to redirect a TCP connection through a service that uses the standard system password database for authentication, such as POP or FTP.
- CVE-1999-1010Dec 14, 1999risk 0.00cvss —epss 0.01
An SSH 1.2.27 server allows a client to use the "none" cipher, even if it is not allowed by the server policy.
Page 7 of 7