CVE-2016-6515

CVE-2016-6515

Published · Updated

Follow this CVE+ Monitor openssh+ Monitor openssh

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

37Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 59%
from disclosure to weapon122 days
Published on NVDAug 7
1st PoC+122d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products (8 components)
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 5
no_fix_planned: Will not fix
Fixed
8 products (456 components)
Red Hat Enterprise Linux Client (v. 7) · Red Hat Enterprise Linux Client Optional (v. 7) · Red Hat Enterprise Linux ComputeNode (v. 7) · Red Hat Enterprise Linux ComputeNode Optional (v. 7) · Red Hat Enterprise Linux Server (v. 7) · and others 3
fix ↗
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.