OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g. for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly other timing attacks against keystroke entry could occur.

🗓️ 11 Sep 2024 07:00:00Reported by MicrosoftType

OpenSSH 9.5–9.7 before 9.8 enables keystroke timing attacks on password prompts via ObscureKeystrokeTiming.

Reporter	Title	Published	Views	Family All 43
FreeBSD	FreeBSD -- OpenSSH Keystroke Obfuscation Bypass	29 Jan 202500:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM i is affected by a timing attack, handling signals in an unsafe manner, and uncontrolled memory consumption due to vulnerabilities in OpenSSH [CVE-2024-39894, CVE-2024-6387, CVE-2025-26466].	7 Aug 202515:48	–	ibm
AlpineLinux	CVE-2024-39894	2 Jul 202418:15	–	alpinelinux
Apple	About the security content of macOS Sequoia 15	16 Sep 202400:00	–	apple
AstraLinux	Astra Linux - уязвимость в openssh	23 Nov 202403:04	–	astralinux
Tenable Nessus	Azure Linux 3.0 Security Update: openssh (CVE-2024-39894)	22 Jan 202600:00	–	nessus
Tenable Nessus	FreeBSD : FreeBSD -- OpenSSH Keystroke Obfuscation Bypass (69e19c0b-debc-11ef-87ba-002590c1f29c)	30 Jan 202500:00	–	nessus
Tenable Nessus	Juniper Junos OS Multiple Vulnerabilities (JSA92873)	28 Apr 202600:00	–	nessus
Tenable Nessus	macOS 15.x < 15.0 Multiple Vulnerabilities (121238)	7 Jan 202500:00	–	nessus
Tenable Nessus	OpenSSH < 9.8 RCE	1 Jul 202400:00	–	nessus