Every CVE Search/ Get API key

CVE-2014-9278

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a...

4.0 MediumFix available

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.

Exploit likelihood

1.83%Up 0.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.0

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.

Record
CVE-2014-9278
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:N/I:P/A:N
Weakness
CWE-287
Updated
2026-11-02
CVE List No score

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.

Record
CVE-2014-9278
Updated
2026-11-02
EUVDEUVD-2014-9103 No score

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.

Record
EUVD-2014-9103
Updated
2026-11-03
GitHub AdvisoriesGHSA-q38j-wxrx-r48r No score

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a...

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.

Record
GHSA-q38j-wxrx-r48r
Weakness
CWE-287
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssh-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-ldap
Red Hat:enterprise_linux:7::client
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server-sysvinit
Red Hat:enterprise_linux:7::client
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
pam_ssh_agent_auth
Red Hat:enterprise_linux:7::client
 before 0:0.9.3-9.11.el7
0:0.9.3-9.11.el7
openssh
Red Hat:enterprise_linux:7::client
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-askpass
Red Hat:enterprise_linux:7::client
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-clients
Red Hat:enterprise_linux:7::client
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-keycat
Red Hat:enterprise_linux:7::client
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server
Red Hat:enterprise_linux:7::client
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-askpass
Red Hat:enterprise_linux:7::computenode
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
Show 26 moreShow less
Affected packages
PackageAffectedFixed
openssh-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-ldap
Red Hat:enterprise_linux:7::computenode
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server-sysvinit
Red Hat:enterprise_linux:7::computenode
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
pam_ssh_agent_auth
Red Hat:enterprise_linux:7::computenode
 before 0:0.9.3-9.11.el7
0:0.9.3-9.11.el7
openssh
Red Hat:enterprise_linux:7::computenode
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-clients
Red Hat:enterprise_linux:7::computenode
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-keycat
Red Hat:enterprise_linux:7::computenode
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server
Red Hat:enterprise_linux:7::computenode
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-ldap
Red Hat:enterprise_linux:7::server
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server-sysvinit
Red Hat:enterprise_linux:7::server
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
pam_ssh_agent_auth
Red Hat:enterprise_linux:7::server
 before 0:0.9.3-9.11.el7
0:0.9.3-9.11.el7
openssh
Red Hat:enterprise_linux:7::server
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-askpass
Red Hat:enterprise_linux:7::server
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-clients
Red Hat:enterprise_linux:7::server
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-keycat
Red Hat:enterprise_linux:7::server
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server
Red Hat:enterprise_linux:7::server
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-ldap
Red Hat:enterprise_linux:7::workstation
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server-sysvinit
Red Hat:enterprise_linux:7::workstation
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
pam_ssh_agent_auth
Red Hat:enterprise_linux:7::workstation
 before 0:0.9.3-9.11.el7
0:0.9.3-9.11.el7
openssh
Red Hat:enterprise_linux:7::workstation
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-askpass
Red Hat:enterprise_linux:7::workstation
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-clients
Red Hat:enterprise_linux:7::workstation
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-keycat
Red Hat:enterprise_linux:7::workstation
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server
Red Hat:enterprise_linux:7::workstation
 before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9278 is a medium vulnerability (CVSS 4.0) in Openbsd Openssh, published December 6, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.83%, the 78th percentile. Fixed in openssh-debuginfo 0:6.6.1p1-11.el7.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open