{"id":"CVE-2016-6210","aliases":["ALPINE-CVE-2016-6210","DEBIAN-CVE-2016-6210","DLA-578-1","DSA-3626-1","EUVD-2016-7143","GHSA-f525-65h3-3qjh","MGASA-2016-0280","RHSA-2017:2029","RHSA-2017:2563","SUSE-SU-2016:2280-1","SUSE-SU-2016:2281-1","SUSE-SU-2016:2388-1","SUSE-SU-2016:2555-1","UBUNTU-CVE-2016-6210","USN-3061-1","openSUSE-SU-2024:10174-1"],"status":"published","title":"sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses...","description":"sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.88944,"percentile":0.9978,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-200"],"published":"2016-07-18T00:00:00Z","modified":"2026-10-24T10:30:34Z","exploits":[{"source":"exploitdb","id":"EDB-40113","title":"OpenSSHd 7.2p2 - Username Enumeration","type":"remote","platform":"linux","date":"2016-07-18","url":"https://www.exploit-db.com/exploits/40113"},{"source":"exploitdb","id":"EDB-40136","title":"OpenSSH 7.2p2 - Username Enumeration","type":"remote","platform":"linux","date":"2016-07-20","url":"https://www.exploit-db.com/exploits/40136"},{"source":"pocgithub","id":"justlce/CVE-2016-6210-Exploit","title":"justlce/CVE-2016-6210-Exploit","date":"2019-08-25","url":"https://github.com/justlce/CVE-2016-6210-Exploit"},{"source":"pocgithub","id":"goomdan/CVE-2016-6210-exploit","title":"goomdan/CVE-2016-6210-exploit","date":"2023-03-19","url":"https://github.com/goomdan/CVE-2016-6210-exploit"},{"source":"pocgithub","id":"samh4cks/CVE-2016-6210-OpenSSH-User-Enumeration","title":"samh4cks/CVE-2016-6210-OpenSSH-User-Enumeration","date":"2023-09-01","url":"https://github.com/samh4cks/CVE-2016-6210-OpenSSH-User-Enumeration"},{"source":"pocgithub","id":"wabiyagi/CVE-2016-6210","title":"wabiyagi/CVE-2016-6210","date":"2025-03-14","url":"https://github.com/wabiyagi/CVE-2016-6210"},{"source":"pocgithub","id":"nicoleman0/CVE-2016-6210-OpenSSHd-7.2p2","title":"nicoleman0/CVE-2016-6210-OpenSSHd-7.2p2","date":"2025-04-12","url":"https://github.com/nicoleman0/CVE-2016-6210-OpenSSHd-7.2p2"},{"source":"pocgithub","id":"KiPhuong/cve-2016-6210","title":"KiPhuong/cve-2016-6210","date":"2025-07-17","url":"https://github.com/KiPhuong/cve-2016-6210"},{"source":"pocgithub","id":"Alisha-chaudhary/ssh-enum","title":"Alisha-chaudhary/ssh-enum","date":"2026-04-30","url":"https://github.com/Alisha-chaudhary/ssh-enum"},{"source":"metasploit","id":"auxiliary/scanner/ssh/ssh_enumusers","title":"SSH Username Enumeration","type":"auxiliary","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/ssh/ssh_enumusers"}],"fixes":[{"ecosystem":"Alpine:v3.2","package":"openssh","fixed_in":["6.8_p1-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"openssh","fixed_in":["7.2_p2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"openssh","fixed_in":["7.2_p2-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openssh","fixed_in":["1:7.2p2-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssh","fixed_in":["1:7.2p2-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssh","fixed_in":["1:7.2p2-6"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"openssh","fixed_in":["1:6.0p1-4+deb7u5"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"openssh","fixed_in":["1:6.7p1-5+deb8u3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-askpass","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-clients","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-debuginfo","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-server","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-ldap","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"pam_ssh_agent_auth","fixed_in":["0:0.9.3-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-clients","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-debuginfo","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-server","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-askpass","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-ldap","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"pam_ssh_agent_auth","fixed_in":["0:0.9.3-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-askpass","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-clients","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-debuginfo","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-server","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-ldap","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"pam_ssh_agent_auth","fixed_in":["0:0.9.3-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-askpass","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-clients","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-debuginfo","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-server","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-ldap","fixed_in":["0:5.3p1-123.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"pam_ssh_agent_auth","fixed_in":["0:0.9.3-123.el6_9"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"openssh","fixed_in":["1:6.6p1-2ubuntu2.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"openssh","fixed_in":["1:7.2p2-4ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8_p1-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2_p2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2_p2-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-6"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.0p1-4+deb7u5"}]}],"versions":["1:6.0p1-4","1:6.0p1-4+deb7u1","1:6.0p1-4+deb7u2","1:6.0p1-4+deb7u3","1:6.0p1-4+deb7u4"]},{"source":"osv","ecosystem":"Debian:8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.7p1-5+deb8u3"}]}],"versions":["1:6.7p1-5","1:6.7p1-5+deb8u1","1:6.7p1-5+deb8u2"]},{"source":"osv","ecosystem":"Mageia:5","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-5.9.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-1.11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-1.11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-1.11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-1.11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3p1-123.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.3-123.el6_9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-28.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-28.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"openssh-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.8"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6","1:6.6p1-2ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.1"}]}],"versions":["1:6.9p1-2","1:6.9p1-3","1:7.1p1-1","1:7.1p1-3","1:7.1p1-4","1:7.1p1-6","1:7.1p2-1","1:7.1p2-2","1:7.2p1-1","1:7.2p2-1","1:7.2p2-2","1:7.2p2-3","1:7.2p2-4","1:7.2p2-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.8"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6","1:6.6p1-2ubuntu2.7"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.1"}]}],"versions":["1:6.9p1-2","1:6.9p1-3","1:7.1p1-1","1:7.1p1-3","1:7.1p1-4","1:7.1p1-6","1:7.1p2-1","1:7.1p2-2","1:7.2p1-1","1:7.2p2-1","1:7.2p2-2","1:7.2p2-3","1:7.2p2-4","1:7.2p2-4ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-3.1"}]}],"bundled":5}],"products":[{"vendor":"openbsd","product":"openssh"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:2563","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"http://www.securitytracker.com/id/1036319","tags":["vdb-entry","x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2016/Jul/51","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"http://www.debian.org/security/2016/dsa-3626","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://www.exploit-db.com/exploits/40136/","tags":["exploit","x_transferred","web"]},{"url":"https://www.exploit-db.com/exploits/40113/","tags":["exploit","x_transferred","web"]},{"url":"https://www.openssh.com/txt/release-7.3","tags":["x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201612-18","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2029","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/91812","tags":["vdb-entry","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190206-0001/","tags":["x_transferred","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6210","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190206-0001"},{"url":"https://www.exploit-db.com/exploits/40113"},{"url":"https://www.exploit-db.com/exploits/40136"},{"url":"https://github.com/advisories/GHSA-f525-65h3-3qjh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-6210","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-6210","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0280.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18222","tags":["report"]},{"url":"https://www.debian.org/security/2016/dsa-3550","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-6210","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/X2L6RW34VFNXYNVVN2CN73YAGJ5VMTFU/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1357442","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1360973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1364935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1366400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1373835","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1375179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1381997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1396400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1398569","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1402424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1406269","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1406286","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1406293","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1418062","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1420910","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1438414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450361","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2029.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6210","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6210","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6515","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6515","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6515","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10009","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10009","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10009","tags":["advisory"]},{"url":"https://www.openssh.com/txt/release-7.4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10011","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10011","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10011","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10012","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10012","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10012","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10708","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1537929","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10708","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2563.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162280-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/948902","tags":["report"]},{"url":"https://bugzilla.suse.com/981654","tags":["report"]},{"url":"https://bugzilla.suse.com/989363","tags":["report"]},{"url":"https://bugzilla.suse.com/992533","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6515","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162281-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162388-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/932483","tags":["report"]},{"url":"https://bugzilla.suse.com/959096","tags":["report"]},{"url":"https://bugzilla.suse.com/962313","tags":["report"]},{"url":"https://bugzilla.suse.com/962794","tags":["report"]},{"url":"https://bugzilla.suse.com/970632","tags":["report"]},{"url":"https://bugzilla.suse.com/975865","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3115","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162555-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/729190","tags":["report"]},{"url":"https://bugzilla.suse.com/960414","tags":["report"]},{"url":"https://bugzilla.suse.com/961368","tags":["report"]},{"url":"https://bugzilla.suse.com/961494","tags":["report"]},{"url":"https://bugzilla.suse.com/965576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6210","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3061-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-6515","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0778","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-6210","description":"sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.","status":"published","published":"2017-02-13T00:00:00Z","modified":"2026-05-29T20:17:40.496Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:33:34.443637Z"}],"euvd":[{"id":"EUVD-2016-7143","description":"sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.","status":"published","published":"2017-02-13T00:00:00Z","modified":"2026-05-29T20:17:40Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:59.967985Z"}],"ghsa":[{"id":"GHSA-f525-65h3-3qjh","title":"sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses...","description":"sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.","status":"published","published":"2022-05-14T01:36:14Z","modified":"2025-04-20T03:33:44Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:01:40.757238Z"}],"nvd":[{"id":"CVE-2016-6210","description":"sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.","status":"published","published":"2017-02-13T17:59:00.153Z","modified":"2026-06-17T00:50:38.27Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:35.822579Z"}],"osv":[{"id":"ALPINE-CVE-2016-6210","description":"sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.","status":"published","published":"2017-02-13T17:59:00.153Z","modified":"2026-09-22T06:30:23.994815938Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"CVE-2016-6210","description":"sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.","status":"published","published":"2017-02-13T17:59:00.153Z","modified":"2026-10-24T10:30:34.174500694Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-6210","description":"sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.","status":"published","published":"2017-02-13T17:59:00.153Z","modified":"2026-09-22T07:03:02.192378408Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"RHSA-2017:2029","title":"Red Hat Security Advisory: openssh security, bug fix, and enhancement update","status":"published","published":"2024-09-16T00:09:10Z","modified":"2026-06-26T12:22:01.156755083Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:2563","title":"Red Hat Security Advisory: openssh security update","status":"published","published":"2024-09-16T00:09:17Z","modified":"2026-06-26T12:22:01.239015218Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2016-6210","description":"sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.","status":"published","published":"2016-07-18T00:00:00Z","modified":"2026-06-01T07:15:29.079291707Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"DLA-578-1","title":"openssh - security update","status":"published","published":"2016-07-30T00:00:00Z","modified":"2026-03-09T02:10:24.268469Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3626-1","title":"openssh - security update","status":"published","published":"2016-07-24T00:00:00Z","modified":"2026-03-09T01:22:58.116857Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0280","title":"Updated openssh packages fix security vulnerability","description":"The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2,\nwhen the UseLogin feature is enabled and PAM is configured to read\n.pam_environment files in user home directories, allows local users to\ngain privileges by triggering a crafted environment for the /bin/login\nprogram, as demonstrated by an LD_PRELOAD environment variable\n(CVE-2015-8325).\n\nWhen SSHD tries to authenticate a non-existing user, it will pick up a\nfake password structure hard-coded in the SSHD source code. An attacker\ncan measure timing information to determine if a user exists when\nverifying a password (CVE-2016-6210).\n\nThe auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3\ndoes not limit password lengths for password authentication, which allows\nremote attackers to cause a denial of service (crypt CPU consumption) via\na long string (CVE-2016-6515).\n\nNote that CVE-2015-8325 and CVE-2016-6210 wouldn't affect most Mageia\nsystems, as UseLogin is not enabled by default and Mageia uses Blowfish\npassword hashes by default.\n","status":"published","published":"2016-08-31T15:32:33Z","modified":"2026-04-16T06:25:38.466293777Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10174-1","title":"openssh-7.2p2-3.1 on GA media","description":"These are all security issues fixed in the openssh-7.2p2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:17:37.440911Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:2280-1","title":"Security update for openssh","description":"\nThis update for openssh fixes the following issues:\n\n- Prevent user enumeration through the timing of password\n  processing (bsc#989363, CVE-2016-6210)\n  [-prevent_timing_user_enumeration]\n- Allow lowering the DH groups parameter limit in server as well\n  as when GSSAPI key exchange is used (bsc#948902)\n- limit accepted password length (prevents possible DoS)\n  (bsc#992533, CVE-2016-6515)\n\nBug fixes:\n- avoid complaining about unset DISPLAY variable (bsc#981654)\n","status":"published","published":"2016-09-09T13:40:21Z","modified":"2026-02-04T03:11:48.026573Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2281-1","title":"Security update for openssh","description":"\nThis update for openssh fixes the following issues:\n\n- CVE-2016-6210: Prevent user enumeration through the timing of password\n  processing (bsc#989363)\n  [-prevent_timing_user_enumeration]\n- Allow lowering the DH groups parameter limit in server as well\n  as when GSSAPI key exchange is used (bsc#948902)\n- CVE-2016-6515: Limiting the accepted password length to prevent possible DoS\n  (bsc#992533)\n\nBug fixes:\n- avoid complaining about unset DISPLAY variable (bsc#981654)\n","status":"published","published":"2016-09-09T13:41:23Z","modified":"2026-02-04T03:31:59.571751Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2388-1","title":"Security update for openssh","description":"\nThis update for OpenSSH fixes the following issues:\n\n- Prevent user enumeration through the timing of password processing.\n  (bsc#989363, CVE-2016-6210)\n- Allow lowering the DH groups parameter limit in server as well as when GSSAPI\n  key exchange is used. (bsc#948902)\n- Sanitize input for xauth(1). (bsc#970632, CVE-2016-3115)\n- Prevent X11 SECURITY circumvention when forwarding X11 connections.\n  (bsc#962313, CVE-2016-1908)\n- Disable DH parameters under 2048 bits by default and allow lowering the limit back\n  to the RFC 4419 specified minimum through an option. (bsc#932483, bsc#948902)\n- Ignore PAM environment when using login. (bsc#975865, CVE-2015-8325)\n- Limit the accepted password length (prevents a possible denial of service).\n  (bsc#992533, CVE-2016-6515)\n- Relax version requires for the openssh-askpass sub-package. (bsc#962794)\n- Avoid complaining about unset DISPLAY variable. (bsc#981654)\n- Initialize message id to prevent connection breakups in some cases. (bsc#959096)\n","status":"published","published":"2016-09-26T15:11:06Z","modified":"2026-02-04T02:43:20.345278Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2555-1","title":"Security update for openssh-openssl1","description":"\nThis update for openssh-openssl1 fixes the following issues:\n\nSecurity issues fixed:\n- CVE-2016-6210: Prevent user enumeration through the timing of password\n  processing (bsc#989363)\n- CVE-2016-6515: limit accepted password length (prevents possible DoS)\n  (bsc#992533)\n- CVE-2016-3115: Sanitise input for xauth(1) (bsc#970632)\n- CVE-2016-1908: prevent X11 SECURITY circumvention when forwarding X11\n  connections (bsc#962313)\n- CVE-2015-8325: ignore PAM environment when using login (bsc#975865)\n- Disable DH parameters under 2048 bits by default and allow\n  lowering the limit back to the RFC 4419 specified minimum\n  through an option (bsc#932483, bsc#948902)\n- Allow lowering the DH groups parameter limit in server as well\n  as when GSSAPI key exchange is used (bsc#948902)\n\nBugs fixed:\n- avoid complaining about unset DISPLAY variable (bsc#981654)\n- Correctly parse GSSAPI KEX algorithms (bsc#961368)\n- more verbose FIPS mode/CC related documentation in README.FIPS\n  (bsc#965576, bsc#960414)\n- fix PRNG re-seeding (bsc#960414, bsc#729190)\n- Allow empty Match blocks (bsc#961494)\n","status":"published","published":"2016-10-17T14:52:50Z","modified":"2026-02-04T03:21:28.414151Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-3061-1","title":"openssh vulnerabilities","description":"Eddie Harari discovered that OpenSSH incorrectly handled password hashing\nwhen authenticating non-existing users. A remote attacker could perform a\ntiming attack and enumerate valid users. (CVE-2016-6210)\n\nTomas Kuthan, Andres Rojas, and Javier Nieto discovered that OpenSSH did\nnot limit password lengths. A remote attacker could use this issue to cause\nOpenSSH to consume resources, leading to a denial of service.\n(CVE-2016-6515)\n","status":"published","published":"2016-08-15T16:39:48Z","modified":"2026-06-01T07:15:22.5282706Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}