CVE-2016-8858

NameCVE-2016-8858
Description** DISPUTED ** The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests. NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh (attack range: remote)
Debian Bugs841884

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
openssh (PTS)jessie1:6.7p1-5+deb8u4vulnerable
jessie (security)1:6.7p1-5+deb8u8vulnerable
stretch1:7.4p1-10+deb9u7fixed
stretch (security)1:7.4p1-10+deb9u6fixed
buster1:7.9p1-10fixed
bullseye, sid1:8.0p1-6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
opensshsource(unstable)1:7.3p1-2high841884

Notes

[jessie] - openssh <ignored> (Minor issue)
[wheezy] - openssh <no-dsa> (Minor issue)
http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/kex.c?rev=1.127&content-type=text/x-cvsweb-markup
Only thing the attacker could do here is self-dos own connection

Search for package or bug name: Reporting problems