CVE-2008-1657

OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config...

6.5 MediumFix available

OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.

Exploit likelihood

2.21%Down 0.3 points since Feb 4, 2022

What each source reports

NVD Score used 6.5

OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.

Record: CVE-2008-1657
CVSS 2.0: 6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.

Record: CVE-2008-1657
Updated: 2026-11-02

EUVDEUVD-2008-1658 No score

OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.

Record: EUVD-2008-1658
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4fmw-7mgw-xgw8 No score

OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config...

OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.

Record: GHSA-4fmw-7mgw-xgw8
Updated: 2026-11-02

OSV No score

OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.

Record: CVE-2008-1657
Updated: 2026-11-02

OSVDEBIAN-CVE-2008-1657 No score

OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.

Record: DEBIAN-CVE-2008-1657
Updated: 2026-11-02

Affected products

openbsd openssh

Affected packages

Affected packages
Package	Affected	Fixed
`openssh` Debian:12	before 1:4.7p1-8	1:4.7p1-8
`openssh` Debian:13	before 1:4.7p1-8	1:4.7p1-8
`openssh` Debian:14	before 1:4.7p1-8	1:4.7p1-8

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-1657 is a medium vulnerability (CVSS 6.5) in Openbsd Openssh, published April 2, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.21%, the 82nd percentile. Fixed in openssh 1:4.7p1-8.

References

Show 28 moreShow less