Read the docs
TI-1999-00013 Aliases CVE-1999-0013GHSA-ch8f-f5g7-vhhr

Stolen credentials from SSH clients via ssh-agent program, allowing other local users to…

Priority MEDIUM 45CWE-522Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-522.

Summary

Stolen credentials from SSH clients via ssh-agent program, allowing other local users to access remote accounts belonging to the ssh-agent user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01139 66th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:ssh:ssh:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableSSH
cpe:2.3:a:ssh:ssh:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableSSH
cpe:2.3:a:ssh:ssh:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableSSH
cpe:2.3:a:ssh:ssh:1.2.3:*:*:*:*:*:*:*1.2.3VulnerableSSH
cpe:2.3:a:ssh:ssh:1.2.4:*:*:*:*:*:*:*1.2.4VulnerableSSH
cpe:2.3:a:ssh:ssh:1.2.5:*:*:*:*:*:*:*1.2.5VulnerableSSH
cpe:2.3:a:ssh:ssh:1.2.6:*:*:*:*:*:*:*1.2.6VulnerableSSH
cpe:2.3:a:ssh:ssh:1.2.7:*:*:*:*:*:*:*1.2.7VulnerableSSH
cpe:2.3:a:ssh:ssh:1.2.8:*:*:*:*:*:*:*1.2.8VulnerableSSH
cpe:2.3:a:ssh:ssh:1.2.9:*:*:*:*:*:*:*1.2.9VulnerableSSH
  • cpe:2.3:a:ssh:ssh:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·SSH
  • cpe:2.3:a:ssh:ssh:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·SSH
  • cpe:2.3:a:ssh:ssh:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·SSH
  • cpe:2.3:a:ssh:ssh:1.2.3:*:*:*:*:*:*:* Versions 1.2.3 Vulnerable ·SSH
  • cpe:2.3:a:ssh:ssh:1.2.4:*:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·SSH
  • cpe:2.3:a:ssh:ssh:1.2.5:*:*:*:*:*:*:* Versions 1.2.5 Vulnerable ·SSH
  • cpe:2.3:a:ssh:ssh:1.2.6:*:*:*:*:*:*:* Versions 1.2.6 Vulnerable ·SSH
  • cpe:2.3:a:ssh:ssh:1.2.7:*:*:*:*:*:*:* Versions 1.2.7 Vulnerable ·SSH
  • cpe:2.3:a:ssh:ssh:1.2.8:*:*:*:*:*:*:* Versions 1.2.8 Vulnerable ·SSH
  • cpe:2.3:a:ssh:ssh:1.2.9:*:*:*:*:*:*:* Versions 1.2.9 Vulnerable ·SSH
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ssh:ssh:1.2.10:*:*:*:*:*:*:*1.2.10VulnerableSSH
cpe:2.3:a:ssh:ssh:1.2.11:*:*:*:*:*:*:*1.2.11VulnerableSSH
cpe:2.3:a:ssh:ssh:1.2.12:*:*:*:*:*:*:*1.2.12VulnerableSSH
cpe:2.3:a:ssh:ssh:1.2.13:*:*:*:*:*:*:*1.2.13VulnerableSSH
cpe:2.3:a:ssh:ssh:1.2.14:*:*:*:*:*:*:*1.2.14VulnerableSSH
  • cpe:2.3:a:ssh:ssh:1.2.10:*:*:*:*:*:*:* Versions 1.2.10 Vulnerable ·SSH
  • cpe:2.3:a:ssh:ssh:1.2.11:*:*:*:*:*:*:* Versions 1.2.11 Vulnerable ·SSH
  • cpe:2.3:a:ssh:ssh:1.2.12:*:*:*:*:*:*:* Versions 1.2.12 Vulnerable ·SSH
  • cpe:2.3:a:ssh:ssh:1.2.13:*:*:*:*:*:*:* Versions 1.2.13 Vulnerable ·SSH
  • cpe:2.3:a:ssh:ssh:1.2.14:*:*:*:*:*:*:* Versions 1.2.14 Vulnerable ·SSH

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-1999-0013
  2. 2026-10-03 Alias added: GHSA-ch8f-f5g7-vhhr

References

—

  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2001-00144 CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to execute… CVSS 2.0HIGH 10.0
  • TI-1999-00245 A race condition in the authentication agent mechanism of sshd 1.2.17 allows an attacker… CVSS 2.0HIGH 10.0
  • TI-2001-00557 The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have… CVSS 2.0HIGH 7.5
  • TI-2001-01425 The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay… CVSS 2.0HIGH 7.5
  • TI-2001-00463 SSH daemon version 1 (aka SSHD-1 or SSH-1) 1.2.30 and earlier does not log repeated login… CVSS 2.0HIGH 7.5
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences