Lucene search

MitreCVELIST:CVE-2024-39894

HistoryJul 02, 2024 - 12:00 a.m.

CVE-2024-39894

2024-07-0200:00:00

mitre

www.cve.org

openssh

timing attacks

echo-off password entry

obscurekeystroketiming logic error.

EPSS

Percentile

10.7%

JSON

OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.

References

www.openwall.com/lists/oss-security/2024/07/03/6

www.openwall.com/lists/oss-security/2024/07/23/4

www.openwall.com/lists/oss-security/2024/07/23/6

www.openwall.com/lists/oss-security/2024/07/28/3

crzphil.github.io/posts/ssh-obfuscation-bypass/

lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html

news.ycombinator.com/item?id=41508530

security.netapp.com/advisory/ntap-20240712-0004/

www.openssh.com/txt/release-9.8

www.openwall.com/lists/oss-security/2024/07/02/1

EPSS

Percentile

10.7%

JSON

Related for CVELIST:CVE-2024-39894