CVE-2019-16905

NameCVE-2019-16905
DescriptionOpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and remote code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
openssh (PTS)jessie1:6.7p1-5+deb8u4fixed
jessie (security)1:6.7p1-5+deb8u8fixed
stretch1:7.4p1-10+deb9u7fixed
stretch (security)1:7.4p1-10+deb9u6fixed
buster1:7.9p1-10vulnerable
buster (security)1:7.9p1-10+deb10u1vulnerable
bullseye, sid1:8.1p1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
opensshsource(unstable)1:8.1p1-1unimportant
opensshsourcejessie(not affected)
opensshsourcestretch(not affected)

Notes

[stretch] - openssh <not-affected> (Vulnerable code introduced later)
[jessie] - openssh <not-affected> (Vulnerable code introduced later)
Issue in experimental (and not enabled) XMSS implementation; futhermore there
is not supported way to enable it when building openssh.

Search for package or bug name: Reporting problems