CVE-2008-5161

Name	CVE-2008-5161
Description	Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	low
Debian Bugs	506115

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
openssh (PTS)	jessie	1:6.7p1-5+deb8u4	fixed
	jessie (security)	1:6.7p1-5+deb8u8	fixed
	stretch	1:7.4p1-10+deb9u7	fixed
	stretch (security)	1:7.4p1-10+deb9u6	fixed
	buster	1:7.9p1-10+deb10u2	fixed
	buster (security)	1:7.9p1-10+deb10u1	fixed
	bullseye, sid	1:8.1p1-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
openssh	source	(unstable)	1:5.1p1-5	low		506115

[etch] - openssh <no-dsa> (Minor issue, see http://www.openssh.org/txt/cbc.adv)