Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2016-6210 →
DEBIAN-CVE-2016-6210
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username doe...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-6"}]}]
Debian:13
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-6"}]}]
Debian:14
openssh
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-6"}]}]
Références
- advisory security-tracker.debian.org