OpenSSH 7.7 through 7.9 and 8.x before 8.1 when compiled with an experimental key type has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions and there is no supported way to enable it when building portable OpenSSH.

🗓️ 25 Sep 2020 07:00:00Reported by MicrosoftType

OpenSSH 7.7–7.9 and 8.x before 8.1 with experimental XMSS keys causes pre-auth overflow, memory corruption, and code execution.

Reporter	Title	Published	Views	Family All 100
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in OpenSSH affects IBM Watson Studio Local	20 Dec 201913:54	–	ibm
GithubExploit	Exploit for Race Condition in Openbsd Openssh	13 Sep 202501:46	–	githubexploit
BDU FSTEC	The vulnerability of the OpenSSH cryptographic protection implementation arises from a possible integer overflow, allowing an attacker to execute arbitrary code.	6 Jul 202100:00	–	bdu_fstec
CBLMariner	CVE-2019-16905 affecting package openssh 8.0p1-13	5 Nov 202004:21	–	cbl_mariner
Circl	CVE-2019-16905	12 Sep 202209:43	–	circl
CVE	CVE-2019-16905	9 Oct 201900:00	–	cve
Cvelist	CVE-2019-16905	9 Oct 201900:00	–	cvelist
Debian CVE	CVE-2019-16905	9 Oct 201900:00	–	debiancve
Tenable Nessus	EulerOS 2.0 SP8 : openssh (EulerOS-SA-2019-2294)	27 Nov 201900:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.5.0 : openssh (EulerOS-SA-2020-1046)	13 Jan 202000:00	–	nessus