{"id":"CVE-2016-6515","aliases":["ALPINE-CVE-2016-6515","BELL-CVE-2016-6515","DEBIAN-CVE-2016-6515","DLA-1500-1","DLA-594-1","EUVD-2016-7437","GHSA-vf2p-h3m7-ch75","MGASA-2016-0280","RHSA-2017:2029","SUSE-SU-2016:2280-1","SUSE-SU-2016:2281-1","SUSE-SU-2016:2388-1","SUSE-SU-2016:2555-1","UBUNTU-CVE-2016-6515","USN-3061-1","openSUSE-SU-2024:10174-1"],"status":"published","title":"The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password...","description":"The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.58568,"percentile":0.99106,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2016-08-07T00:00:00Z","modified":"2026-10-20T13:18:00Z","exploits":[{"source":"exploitdb","id":"EDB-40888","title":"OpenSSH 7.2 - Denial of Service","type":"dos","platform":"linux","date":"2016-12-07","url":"https://www.exploit-db.com/exploits/40888"},{"source":"pocgithub","id":"opsxcq/exploit-CVE-2016-6515","title":"opsxcq/exploit-CVE-2016-6515","date":"2016-12-09","url":"https://github.com/opsxcq/exploit-CVE-2016-6515"},{"source":"pocgithub","id":"cved-sources/cve-2016-6515","title":"cved-sources/cve-2016-6515","date":"2019-01-06","url":"https://github.com/cved-sources/cve-2016-6515"},{"source":"pocgithub","id":"jptr218/openssh_dos","title":"jptr218/openssh_dos","date":"2021-08-26","url":"https://github.com/jptr218/openssh_dos"}],"fixes":[{"ecosystem":"Alpine:v3.2","package":"openssh","fixed_in":["6.8_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"openssh","fixed_in":["7.2_p2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"openssh","fixed_in":["7.2_p2-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openssh","fixed_in":["1:7.3p1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssh","fixed_in":["1:7.3p1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssh","fixed_in":["1:7.3p1-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"openssh","fixed_in":["1:6.0p1-4+deb7u6"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"openssh","fixed_in":["1:6.6p1-2ubuntu2.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"openssh","fixed_in":["1:7.2p2-4ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2_p2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2_p2-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.3p1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.3p1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.3p1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.7p1-5+deb8u6"}]}],"versions":["1:6.7p1-5","1:6.7p1-5+deb8u1","1:6.7p1-5+deb8u2","1:6.7p1-5+deb8u3","1:6.7p1-5+deb8u4","1:6.7p1-5+deb8u5"],"bundled":12},{"source":"osv","ecosystem":"Debian:7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.0p1-4+deb7u6"}]}],"versions":["1:6.0p1-4","1:6.0p1-4+deb7u1","1:6.0p1-4+deb7u2","1:6.0p1-4+deb7u3","1:6.0p1-4+deb7u4","1:6.0p1-4+deb7u5"]},{"source":"osv","ecosystem":"Mageia:5","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-5.9.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-1.11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-1.11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-1.11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-1.11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-52.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-28.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-28.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.33.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"openssh-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.8"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6","1:6.6p1-2ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.1"}]}],"versions":["1:6.9p1-2","1:6.9p1-3","1:7.1p1-1","1:7.1p1-3","1:7.1p1-4","1:7.1p1-6","1:7.1p2-1","1:7.1p2-2","1:7.2p1-1","1:7.2p2-1","1:7.2p2-2","1:7.2p2-3","1:7.2p2-4","1:7.2p2-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.8"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6","1:6.6p1-2ubuntu2.7"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.1"}]}],"versions":["1:6.9p1-2","1:6.9p1-3","1:7.1p1-1","1:7.1p1-3","1:7.1p1-4","1:7.1p1-6","1:7.1p2-1","1:7.1p2-2","1:7.2p1-1","1:7.2p2-1","1:7.2p2-2","1:7.2p2-3","1:7.2p2-4","1:7.2p2-4ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-3.1"}]}],"bundled":5}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"openbsd","product":"openssh"}],"references":[{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03779en_us","tags":["x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20171130-0003/","tags":["x_transferred","advisory"]},{"url":"https://github.com/openssh/openssh-portable/commit/fcd135c9df440bcd2d5870405ad3311743d78d97","tags":["x_transferred","Issue Tracking","Patch","fix"]},{"url":"http://packetstormsecurity.com/files/140070/OpenSSH-7.2-Denial-Of-Service.html","tags":["x_transferred","web"]},{"url":"https://www.exploit-db.com/exploits/40888/","tags":["exploit","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/92212","tags":["vdb-entry","x_transferred","web"]},{"url":"https://security.FreeBSD.org/advisories/FreeBSD-SA-17:06.openssh.asc","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_transferred","advisory"]},{"url":"http://www.securitytracker.com/id/1036487","tags":["vdb-entry","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X2L6RW34VFNXYNVVN2CN73YAGJ5VMTFU/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2029","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","tags":["mailing-list","x_transferred","web"]},{"url":"http://openwall.com/lists/oss-security/2016/08/01/2","tags":["mailing-list","x_transferred","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf","tags":["x_transferred","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6515","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X2L6RW34VFNXYNVVN2CN73YAGJ5VMTFU"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X2L6RW34VFNXYNVVN2CN73YAGJ5VMTFU"},{"url":"https://security.netapp.com/advisory/ntap-20171130-0003"},{"url":"https://www.exploit-db.com/exploits/40888"},{"url":"https://github.com/advisories/GHSA-vf2p-h3m7-ch75"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-6515","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2016-6515","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-6515","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0280.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18222","tags":["report"]},{"url":"https://www.debian.org/security/2016/dsa-3550","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-6210","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/X2L6RW34VFNXYNVVN2CN73YAGJ5VMTFU/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1357442","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1360973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1364935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1366400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1373835","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1375179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1381997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1396400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1398569","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1402424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1406269","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1406286","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1406293","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1418062","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1420910","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1438414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450361","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2029.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6210","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6210","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6210","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6515","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6515","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10009","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10009","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10009","tags":["advisory"]},{"url":"https://www.openssh.com/txt/release-7.4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10011","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10011","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10011","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10012","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10012","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10012","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10708","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1537929","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10708","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162280-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/948902","tags":["report"]},{"url":"https://bugzilla.suse.com/981654","tags":["report"]},{"url":"https://bugzilla.suse.com/989363","tags":["report"]},{"url":"https://bugzilla.suse.com/992533","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6515","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162281-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162388-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/932483","tags":["report"]},{"url":"https://bugzilla.suse.com/959096","tags":["report"]},{"url":"https://bugzilla.suse.com/962313","tags":["report"]},{"url":"https://bugzilla.suse.com/962794","tags":["report"]},{"url":"https://bugzilla.suse.com/970632","tags":["report"]},{"url":"https://bugzilla.suse.com/975865","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3115","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162555-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/729190","tags":["report"]},{"url":"https://bugzilla.suse.com/960414","tags":["report"]},{"url":"https://bugzilla.suse.com/961368","tags":["report"]},{"url":"https://bugzilla.suse.com/961494","tags":["report"]},{"url":"https://bugzilla.suse.com/965576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6515","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3061-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-6210","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0778","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-6515","description":"The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.","status":"published","published":"2016-08-07T00:00:00Z","modified":"2024-08-06T01:29:20.223Z","updated_at":"2026-11-02T14:33:34.443637Z"}],"euvd":[{"id":"EUVD-2016-7437","description":"The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.","status":"published","published":"2016-08-07T00:00:00Z","modified":"2024-08-06T01:29:20Z","updated_at":"2026-11-03T02:22:36.370031Z"}],"ghsa":[{"id":"GHSA-vf2p-h3m7-ch75","title":"The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password...","description":"The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.","status":"published","published":"2022-05-13T01:05:57Z","modified":"2025-04-12T13:03:23Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:28.663035Z"}],"nvd":[{"id":"CVE-2016-6515","description":"The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.","status":"published","published":"2016-08-07T21:59:09.943Z","modified":"2026-06-17T00:51:18.35Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:28.854267Z"}],"osv":[{"id":"ALPINE-CVE-2016-6515","description":"The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.","status":"published","published":"2016-08-07T21:59:09.943Z","modified":"2026-09-22T06:30:26.683088504Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"BELL-CVE-2016-6515","title":"CVE-2016-6515 does not affect BellSoft software","status":"withdrawn","published":"2016-08-07T21:59:00Z","modified":"2026-01-26T09:47:54.040019Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2016-6515","description":"The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.","status":"published","published":"2016-08-07T21:59:09.943Z","modified":"2026-10-20T13:18:00.055802108Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-6515","description":"The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.","status":"published","published":"2016-08-07T21:59:09.943Z","modified":"2026-09-22T07:00:27.508509635Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"RHSA-2017:2029","title":"Red Hat Security Advisory: openssh security, bug fix, and enhancement update","status":"published","published":"2024-09-16T00:09:10Z","modified":"2026-06-26T12:22:01.156755083Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2016-6515","description":"The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.","status":"published","published":"2016-08-07T00:00:00Z","modified":"2026-02-04T03:05:09.061241Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"DLA-1500-1","title":"openssh - security update","status":"published","published":"2018-09-10T00:00:00Z","modified":"2026-03-09T01:01:44.380043Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-594-1","title":"openssh - security update","status":"published","published":"2016-08-12T00:00:00Z","modified":"2026-03-09T02:10:24.986207Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2016-0280","title":"Updated openssh packages fix security vulnerability","description":"The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2,\nwhen the UseLogin feature is enabled and PAM is configured to read\n.pam_environment files in user home directories, allows local users to\ngain privileges by triggering a crafted environment for the /bin/login\nprogram, as demonstrated by an LD_PRELOAD environment variable\n(CVE-2015-8325).\n\nWhen SSHD tries to authenticate a non-existing user, it will pick up a\nfake password structure hard-coded in the SSHD source code. An attacker\ncan measure timing information to determine if a user exists when\nverifying a password (CVE-2016-6210).\n\nThe auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3\ndoes not limit password lengths for password authentication, which allows\nremote attackers to cause a denial of service (crypt CPU consumption) via\na long string (CVE-2016-6515).\n\nNote that CVE-2015-8325 and CVE-2016-6210 wouldn't affect most Mageia\nsystems, as UseLogin is not enabled by default and Mageia uses Blowfish\npassword hashes by default.\n","status":"published","published":"2016-08-31T15:32:33Z","modified":"2026-04-16T06:25:38.466293777Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10174-1","title":"openssh-7.2p2-3.1 on GA media","description":"These are all security issues fixed in the openssh-7.2p2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:17:37.440911Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:2280-1","title":"Security update for openssh","description":"\nThis update for openssh fixes the following issues:\n\n- Prevent user enumeration through the timing of password\n  processing (bsc#989363, CVE-2016-6210)\n  [-prevent_timing_user_enumeration]\n- Allow lowering the DH groups parameter limit in server as well\n  as when GSSAPI key exchange is used (bsc#948902)\n- limit accepted password length (prevents possible DoS)\n  (bsc#992533, CVE-2016-6515)\n\nBug fixes:\n- avoid complaining about unset DISPLAY variable (bsc#981654)\n","status":"published","published":"2016-09-09T13:40:21Z","modified":"2026-02-04T03:11:48.026573Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2281-1","title":"Security update for openssh","description":"\nThis update for openssh fixes the following issues:\n\n- CVE-2016-6210: Prevent user enumeration through the timing of password\n  processing (bsc#989363)\n  [-prevent_timing_user_enumeration]\n- Allow lowering the DH groups parameter limit in server as well\n  as when GSSAPI key exchange is used (bsc#948902)\n- CVE-2016-6515: Limiting the accepted password length to prevent possible DoS\n  (bsc#992533)\n\nBug fixes:\n- avoid complaining about unset DISPLAY variable (bsc#981654)\n","status":"published","published":"2016-09-09T13:41:23Z","modified":"2026-02-04T03:31:59.571751Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2388-1","title":"Security update for openssh","description":"\nThis update for OpenSSH fixes the following issues:\n\n- Prevent user enumeration through the timing of password processing.\n  (bsc#989363, CVE-2016-6210)\n- Allow lowering the DH groups parameter limit in server as well as when GSSAPI\n  key exchange is used. (bsc#948902)\n- Sanitize input for xauth(1). (bsc#970632, CVE-2016-3115)\n- Prevent X11 SECURITY circumvention when forwarding X11 connections.\n  (bsc#962313, CVE-2016-1908)\n- Disable DH parameters under 2048 bits by default and allow lowering the limit back\n  to the RFC 4419 specified minimum through an option. (bsc#932483, bsc#948902)\n- Ignore PAM environment when using login. (bsc#975865, CVE-2015-8325)\n- Limit the accepted password length (prevents a possible denial of service).\n  (bsc#992533, CVE-2016-6515)\n- Relax version requires for the openssh-askpass sub-package. (bsc#962794)\n- Avoid complaining about unset DISPLAY variable. (bsc#981654)\n- Initialize message id to prevent connection breakups in some cases. (bsc#959096)\n","status":"published","published":"2016-09-26T15:11:06Z","modified":"2026-02-04T02:43:20.345278Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2555-1","title":"Security update for openssh-openssl1","description":"\nThis update for openssh-openssl1 fixes the following issues:\n\nSecurity issues fixed:\n- CVE-2016-6210: Prevent user enumeration through the timing of password\n  processing (bsc#989363)\n- CVE-2016-6515: limit accepted password length (prevents possible DoS)\n  (bsc#992533)\n- CVE-2016-3115: Sanitise input for xauth(1) (bsc#970632)\n- CVE-2016-1908: prevent X11 SECURITY circumvention when forwarding X11\n  connections (bsc#962313)\n- CVE-2015-8325: ignore PAM environment when using login (bsc#975865)\n- Disable DH parameters under 2048 bits by default and allow\n  lowering the limit back to the RFC 4419 specified minimum\n  through an option (bsc#932483, bsc#948902)\n- Allow lowering the DH groups parameter limit in server as well\n  as when GSSAPI key exchange is used (bsc#948902)\n\nBugs fixed:\n- avoid complaining about unset DISPLAY variable (bsc#981654)\n- Correctly parse GSSAPI KEX algorithms (bsc#961368)\n- more verbose FIPS mode/CC related documentation in README.FIPS\n  (bsc#965576, bsc#960414)\n- fix PRNG re-seeding (bsc#960414, bsc#729190)\n- Allow empty Match blocks (bsc#961494)\n","status":"published","published":"2016-10-17T14:52:50Z","modified":"2026-02-04T03:21:28.414151Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-3061-1","title":"openssh vulnerabilities","description":"Eddie Harari discovered that OpenSSH incorrectly handled password hashing\nwhen authenticating non-existing users. A remote attacker could perform a\ntiming attack and enumerate valid users. (CVE-2016-6210)\n\nTomas Kuthan, Andres Rojas, and Javier Nieto discovered that OpenSSH did\nnot limit password lengths. A remote attacker could use this issue to cause\nOpenSSH to consume resources, leading to a denial of service.\n(CVE-2016-6515)\n","status":"published","published":"2016-08-15T16:39:48Z","modified":"2026-06-01T07:15:22.5282706Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}