Every CVESearch/Get API key

CVE-2010-5107

The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing...

5.0 MediumFix available

CVE-2010-5107 is a medium vulnerability (CVSS 5.0) in Openbsd Openssh, published March 7, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.9%, the 97th percentile. Fixed in openssh 1:6.0p1-4.

What does this mean?
Severity
5.0 MediumCVSS 2.0, NVD
Exploit chance
16.9%EPSS, 97th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1:6.0p1-4openssh +31 more

Description

The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.

Exploit likelihood

16.9%Up 14.8 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssh
Debian:12
before 1:6.0p1-4
1:6.0p1-4
openssh
Debian:13
before 1:6.0p1-4
1:6.0p1-4
openssh
Debian:14
before 1:6.0p1-4
1:6.0p1-4
rhev-hypervisor6
Red Hat:enterprise_linux:6::hypervisor
From an advisory covering 6 CVEs
before 0:6.5-20131115.0.3.2.el6_5
0:6.5-20131115.0.3.2.el6_5
openssh
Red Hat:enterprise_linux:6::client
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh-debuginfo
Red Hat:enterprise_linux:6::client
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh-ldap
Red Hat:enterprise_linux:6::client
before 0:5.3p1-94.el6
0:5.3p1-94.el6
pam_ssh_agent_auth
Red Hat:enterprise_linux:6::client
before 0:0.9.3-94.el6
0:0.9.3-94.el6
openssh-askpass
Red Hat:enterprise_linux:6::client
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh-clients
Red Hat:enterprise_linux:6::client
before 0:5.3p1-94.el6
0:5.3p1-94.el6
Show 22 moreShow less
Affected packages
PackageAffectedFixed
openssh-server
Red Hat:enterprise_linux:6::client
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh
Red Hat:enterprise_linux:6::computenode
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh-askpass
Red Hat:enterprise_linux:6::computenode
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh-debuginfo
Red Hat:enterprise_linux:6::computenode
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh-ldap
Red Hat:enterprise_linux:6::computenode
before 0:5.3p1-94.el6
0:5.3p1-94.el6
pam_ssh_agent_auth
Red Hat:enterprise_linux:6::computenode
before 0:0.9.3-94.el6
0:0.9.3-94.el6
openssh-clients
Red Hat:enterprise_linux:6::computenode
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh-server
Red Hat:enterprise_linux:6::computenode
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh
Red Hat:enterprise_linux:6::server
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh-debuginfo
Red Hat:enterprise_linux:6::server
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh-ldap
Red Hat:enterprise_linux:6::server
before 0:5.3p1-94.el6
0:5.3p1-94.el6
pam_ssh_agent_auth
Red Hat:enterprise_linux:6::server
before 0:0.9.3-94.el6
0:0.9.3-94.el6
openssh-askpass
Red Hat:enterprise_linux:6::server
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh-clients
Red Hat:enterprise_linux:6::server
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh-server
Red Hat:enterprise_linux:6::server
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh
Red Hat:enterprise_linux:6::workstation
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh-debuginfo
Red Hat:enterprise_linux:6::workstation
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh-ldap
Red Hat:enterprise_linux:6::workstation
before 0:5.3p1-94.el6
0:5.3p1-94.el6
pam_ssh_agent_auth
Red Hat:enterprise_linux:6::workstation
before 0:0.9.3-94.el6
0:0.9.3-94.el6
openssh-askpass
Red Hat:enterprise_linux:6::workstation
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh-clients
Red Hat:enterprise_linux:6::workstation
before 0:5.3p1-94.el6
0:5.3p1-94.el6
openssh-server
Red Hat:enterprise_linux:6::workstation
before 0:5.3p1-94.el6
0:5.3p1-94.el6

What each source reports

CVE List7.5

The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.

Record
CVE-2010-5107
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2010-50677.5

The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.

Record
EUVD-2010-5067
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-w6q4-qg4h-298g7.5

The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing...

The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.

Record
GHSA-w6q4-qg4h-298g
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
NVD7.5

The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.

Record
CVE-2010-5107
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-400
Updated
2026-11-02
OSVDEBIAN-CVE-2010-51077.5

The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.

Record
DEBIAN-CVE-2010-5107
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVNo score

The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.

Record
CVE-2010-5107
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 42 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open