The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

🗓️ 25 Sep 2020 00:00:00Reported by MicrosoftType

OpenSSH five seven to eight four leaks data in algorithm negotiation, enabling a man in the middle on first connections.

Reporter	Title	Published	Views	Family All 182
IBM Security Bulletins	Security Bulletin: Vulnerability in OpenSSH affects IBM Integrated Analytics System	13 May 202110:23	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in OpenSSH affects IBM Integrated Analytics System (Sailfish) [CVE-2020-14145].	27 May 202514:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Insights is affected by multiple vulnerabilities	12 Jan 202120:04	–	ibm
GithubExploit	Exploit for Observable Discrepancy in Openbsd Openssh	17 Oct 202519:10	–	githubexploit
GithubExploit	Exploit for Race Condition in Openbsd Openssh	13 Sep 202501:46	–	githubexploit
Tenable Nessus	Alibaba Cloud Linux 3 : 0188: openssh (ALINUX3-SA-2022:0188)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : openssh (ALSA-2021:4368)	9 Feb 202200:00	–	nessus
Tenable Nessus	CentOS 8 : openssh (CESA-2021:4368)	13 Nov 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : openssh (EulerOS-SA-2021-1159)	1 Feb 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : openssh (EulerOS-SA-2021-1251)	5 Feb 202100:00	–	nessus