CVE-2005-2666
SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames,...
SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.
Exploit likelihood
What each source reports
NVD Score used
SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.
- Record
CVE-2005-2666- CVSS 2.0
- 1.2 Low
AV:L/AC:H/Au:N/C:P/I:N/A:N - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE List No score
SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.
- Record
CVE-2005-2666- Updated
- 2026-11-02
EUVDEUVD-2005-2667 No score
SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.
- Record
EUVD-2005-2667- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rfm3-rfv4-crj6 No score
SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames,...
SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.
- Record
GHSA-rfm3-rfv4-crj6- Updated
- 2026-11-02
OSVBELL-CVE-2005-2666
CVE-2005-2666 does not affect BellSoft software
- Record
BELL-CVE-2005-2666- CVSS 2.0
- 1.2 Low
AV:L/AC:H/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
OSV No score
SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.
- Record
CVE-2005-2666- Updated
- 2026-11-02
OSVDEBIAN-CVE-2005-2666 No score
SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.
- Record
DEBIAN-CVE-2005-2666- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensshDebian:12 |
before 1:4.0p1-1 | 1:4.0p1-1 |
opensshDebian:13 |
before 1:4.0p1-1 | 1:4.0p1-1 |
opensshDebian:14 |
before 1:4.0p1-1 | 1:4.0p1-1 |
opensshRed Hat:enterprise_linux:4::as |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-askpassRed Hat:enterprise_linux:4::as |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-askpass-gnomeRed Hat:enterprise_linux:4::as |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-clientsRed Hat:enterprise_linux:4::as |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-debuginfoRed Hat:enterprise_linux:4::as |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-serverRed Hat:enterprise_linux:4::as |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
opensshRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openssh-askpassRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-askpass-gnomeRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-clientsRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-serverRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
opensshRed Hat:enterprise_linux:4::es |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-askpassRed Hat:enterprise_linux:4::es |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-askpass-gnomeRed Hat:enterprise_linux:4::es |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-clientsRed Hat:enterprise_linux:4::es |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-debuginfoRed Hat:enterprise_linux:4::es |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-serverRed Hat:enterprise_linux:4::es |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
opensshRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-askpassRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-askpass-gnomeRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-clientsRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
openssh-serverRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-8.RHEL4.20 | 0:3.9p1-8.RHEL4.20 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2005-2666 is a low vulnerability (CVSS 1.2) in Openbsd Openssh, published August 23, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 67th percentile. Fixed in openssh 1:4.0p1-1.
References
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10201
secunia.com/advisories/25098
redhat.com/support/errata/RHSA-2007-0257.html
eweek.com/article2/0%2C1759%2C1815795%2C00.asp
nms.csail.mit.edu/projects/ssh
Show 15 moreShow less
nvd.nist.gov/vuln/detail/CVE-2005-2666
github.com/advisories/GHSA-rfm3-rfv4-crj6
docs.bell-sw.com/security/cves/CVE-2005-2666
security-tracker.debian.org/tracker/CVE-2005-2666
access.redhat.com/errata/RHSA-2007:0257
bugzilla.redhat.com/show_bug.cgi?id=162681
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0257.json
cve.org/CVERecord?id=CVE-2005-2666