CVE-2001-0572
The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various...
The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information via sniffing: (1) password lengths or ranges of lengths, which simplifies brute force password guessing, (2) whether RSA or DSA authentication is being used, (3) the number of authorized_keys in RSA authentication, or (4) the lengths of shell commands.
Exploit likelihood
What each source reports
NVD Score used
The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information via sniffing: (1) password lengths or ranges of lengths, which simplifies brute force password guessing, (2) whether RSA or DSA authentication is being used, (3) the number of authorized_keys in RSA authentication, or (4) the lengths of shell commands.
- Record
CVE-2001-0572- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information via sniffing: (1) password lengths or ranges of lengths, which simplifies brute force password guessing, (2) whether RSA or DSA authentication is being used, (3) the number of authorized_keys in RSA authentication, or (4) the lengths of shell commands.
- Record
CVE-2001-0572- Updated
- 2026-11-02
EUVDEUVD-2001-0564 No score
The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information via sniffing: (1) password lengths or ranges of lengths, which simplifies brute force password guessing, (2) whether RSA or DSA authentication is being used, (3) the number of authorized_keys in RSA authentication, or (4) the lengths of shell commands.
- Record
EUVD-2001-0564- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m5hh-422h-x5pc No score
The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various...
The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information via sniffing: (1) password lengths or ranges of lengths, which simplifies brute force password guessing, (2) whether RSA or DSA authentication is being used, (3) the number of authorized_keys in RSA authentication, or (4) the lengths of shell commands.
- Record
GHSA-m5hh-422h-x5pc- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2001-0572 is a high vulnerability (CVSS 7.5) in Openbsd Openssh, published July 27, 2001. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.05%, the 94th percentile. No source names a fixed version.
References
linux-mandrake.com/en/security/2001/MDKSA-2001-033.php3
redhat.com/support/errata/RHSA-2001-033.html
archives.neohapsis.com/archives/bugtraq/2001-03/0225.html
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000391
kb.cert.org/vuls/id/596827
nvd.nist.gov/vuln/detail/CVE-2001-0572
github.com/advisories/GHSA-m5hh-422h-x5pc