Red Hat Security AdvisoryRHSA-2017:2563
openssh security update
Released 2017-08-31 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) openssh-5.3p1-123.el6_9, openssh-askpass-5.3p1-123.el6_9, openssh-clients-5.3p1-123.el6_9 +1
- Red Hat Enterprise Linux Desktop Optional (v. 6) openssh-ldap-5.3p1-123.el6_9, pam_ssh_agent_auth-0.9.3-123.el6_9
- Red Hat Enterprise Linux HPC Node (v. 6) openssh-5.3p1-123.el6_9, openssh-clients-5.3p1-123.el6_9, openssh-server-5.3p1-123.el6_9
- Red Hat Enterprise Linux HPC Node Optional (v. 6) openssh-askpass-5.3p1-123.el6_9, openssh-ldap-5.3p1-123.el6_9, pam_ssh_agent_auth-0.9.3-123.el6_9
- Red Hat Enterprise Linux Server (v. 6) openssh-5.3p1-123.el6_9, openssh-askpass-5.3p1-123.el6_9, openssh-clients-5.3p1-123.el6_9 +1
- Red Hat Enterprise Linux Server Optional (v. 6) openssh-ldap-5.3p1-123.el6_9, pam_ssh_agent_auth-0.9.3-123.el6_9, pam_ssh_agent_auth-0.9.3-123.el6_9.ppc
- Red Hat Enterprise Linux Workstation (v. 6) openssh-5.3p1-123.el6_9, openssh-askpass-5.3p1-123.el6_9, openssh-clients-5.3p1-123.el6_9 +1
- Red Hat Enterprise Linux Workstation Optional (v. 6) openssh-ldap-5.3p1-123.el6_9, pam_ssh_agent_auth-0.9.3-123.el6_9
Fixes 1 record
Priority HIGH 69
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by lever…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.88944 · Published 2017-02-13 · Partial fix CWE-200
