Every CVESearch/Get API key

CVE-2014-9278

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a...

4.0 Medium

CVE-2014-9278 is a medium vulnerability (CVSS 4.0) in Openbsd Openssh, published December 6, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.83%, the 79th percentile. No source names a fixed version.

What does this mean?
Severity
4.0 MediumCVSS 2.0, NVD
Exploit chance
1.83%EPSS, 79th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.

Exploit likelihood

1.83%Up 0.5 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssh-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-ldap
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server-sysvinit
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
pam_ssh_agent_auth
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
before 0:0.9.3-9.11.el7
0:0.9.3-9.11.el7
openssh
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-askpass
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-clients
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-keycat
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-askpass
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
Show 26 moreShow less
Affected packages
PackageAffectedFixed
openssh-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-ldap
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server-sysvinit
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
pam_ssh_agent_auth
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
before 0:0.9.3-9.11.el7
0:0.9.3-9.11.el7
openssh
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-clients
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-keycat
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-ldap
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server-sysvinit
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
pam_ssh_agent_auth
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
before 0:0.9.3-9.11.el7
0:0.9.3-9.11.el7
openssh
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-askpass
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-clients
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-keycat
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-ldap
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server-sysvinit
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
pam_ssh_agent_auth
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
before 0:0.9.3-9.11.el7
0:0.9.3-9.11.el7
openssh
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-askpass
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-clients
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-keycat
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7
openssh-server
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
before 0:6.6.1p1-11.el7
0:6.6.1p1-11.el7

What each source reports

NVD Score used4.0

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.

Record
CVE-2014-9278
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:N/I:P/A:N
Weakness
CWE-287
Updated
2026-11-02
CVE ListNo score

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.

Record
CVE-2014-9278
Updated
2026-11-02
EUVDEUVD-2014-9103No score

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.

Record
EUVD-2014-9103
Updated
2026-11-03
GitHub AdvisoriesGHSA-q38j-wxrx-r48rNo score

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a...

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.

Record
GHSA-q38j-wxrx-r48r
Weakness
CWE-287
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 24 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open