{"id":"CVE-2024-39894","aliases":["AZL-43140","BELL-CVE-2024-39894","DEBIAN-CVE-2024-39894","EUVD-2024-38350","GHSA-g5qj-pfmg-p3jp","SUSE-SU-2024:2393-1","SUSE-SU-2025:20009-1","UBUNTU-CVE-2024-39894","USN-6887-1","openSUSE-SU-2024:14113-1"],"status":"published","title":"OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password...","description":"OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.01634,"percentile":0.76644,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-367"],"published":"2024-07-02T00:00:00Z","modified":"2026-11-02T12:00:14Z","fixes":[{"ecosystem":"Azure Linux:3","package":"openssh","fixed_in":["9.8p1-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssh","fixed_in":["9.8_p1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssh","fixed_in":["9.8_p1-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssh","fixed_in":["1:9.8p1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssh","fixed_in":["1:9.8p1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"openssh","fixed_in":["1:9.6p1-3ubuntu13.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.8p1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.5_p1-r0"},{"fixed":"9.8_p1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.5_p1-r0"},{"fixed":"9.8_p1-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.8p1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.8p1-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-150600.6.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-150600.6.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-150600.6.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-150600.6.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.6p1-3ubuntu13.4"}]}],"versions":["1:9.3p1-1ubuntu3","1:9.4p1-1ubuntu1","1:9.6p1-3ubuntu1","1:9.6p1-3ubuntu2","1:9.6p1-3ubuntu11","1:9.6p1-3ubuntu12","1:9.6p1-3ubuntu13","1:9.6p1-3ubuntu13.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.6p1-3ubuntu13.4"}]}],"versions":["1:9.3p1-1ubuntu3","1:9.4p1-1ubuntu1","1:9.6p1-3ubuntu1","1:9.6p1-3ubuntu2","1:9.6p1-3ubuntu11","1:9.6p1-3ubuntu12","1:9.6p1-3ubuntu13","1:9.6p1-3ubuntu13.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6p1-11.1"}]}],"bundled":2}],"products":[{"vendor":"openbsd","product":"openssh"}],"references":[{"url":"https://www.openssh.com/txt/release-9.8","tags":["x_transferred","web","report"]},{"url":"https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html","tags":["x_transferred","web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/07/02/1","tags":["x_transferred","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/03/6","tags":["mailing-list","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240712-0004/","tags":["x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/23/4","tags":["mailing-list","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/23/6","tags":["mailing-list","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/28/3","tags":["mailing-list","x_transferred","web"]},{"url":"https://crzphil.github.io/posts/ssh-obfuscation-bypass/","tags":["web"]},{"url":"https://news.ycombinator.com/item?id=41508530","tags":["web"]},{"url":"https://www.freebsd.org/security/advisories/FreeBSD-SA-25:01.openssh.asc","tags":["advisory"]},{"url":"http://seclists.org/fulldisclosure/2024/Sep/33"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39894","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20240712-0004"},{"url":"https://crzphil.github.io/posts/ssh-obfuscation-bypass"},{"url":"https://github.com/advisories/GHSA-g5qj-pfmg-p3jp"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-39894","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-39894","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242393-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218215","tags":["report"]},{"url":"https://bugzilla.suse.com/1224392","tags":["report"]},{"url":"https://bugzilla.suse.com/1225904","tags":["report"]},{"url":"https://bugzilla.suse.com/1227318","tags":["report"]},{"url":"https://bugzilla.suse.com/1227350","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-51385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39894","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520009-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1217950","tags":["report"]},{"url":"https://bugzilla.suse.com/1226642","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6387","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-39894","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-39894","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6887-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-39894","description":"OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.","status":"published","published":"2024-07-02T00:00:00Z","modified":"2025-11-04T16:12:30.897Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-38350","description":"OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.","status":"published","published":"2024-07-02T00:00:00Z","modified":"2025-11-04T16:12:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:28.888576Z"}],"ghsa":[{"id":"GHSA-g5qj-pfmg-p3jp","title":"OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password...","description":"OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.","status":"published","published":"2024-07-02T21:32:15Z","modified":"2025-11-04T18:31:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:04:33.412684Z"}],"nvd":[{"id":"CVE-2024-39894","description":"OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.","status":"published","published":"2024-07-02T18:15:03.71Z","modified":"2026-06-17T07:42:58.77Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:10:10.545705Z"}],"osv":[{"id":"BELL-CVE-2024-39894","status":"published","published":"2024-07-04T05:57:16.32076Z","modified":"2026-01-26T09:36:45.527415Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:20.200735Z"},{"id":"DEBIAN-CVE-2024-39894","description":"OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.","status":"published","published":"2024-07-02T18:15:03.71Z","modified":"2026-11-02T12:00:14.351012076Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"UBUNTU-CVE-2024-39894","description":"OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.","status":"published","published":"2024-07-02T18:15:00Z","modified":"2026-02-04T02:25:25.251626Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"AZL-43140","title":"CVE-2024-39894 affecting package openssh for versions less than 9.8p1-1","description":"OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.","status":"published","published":"2024-07-02T18:15:03Z","modified":"2026-04-21T04:55:30.528238Z","updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"CVE-2024-39894","description":"OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.","status":"published","published":"2024-07-02T18:15:03Z","modified":"2026-04-10T05:14:41.324384Z","updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"openSUSE-SU-2024:14113-1","title":"openssh-9.6p1-11.1 on GA media","description":"These are all security issues fixed in the openssh-9.6p1-11.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-08T00:00:00Z","modified":"2026-02-04T04:18:32.857437Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:2393-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2024-39894: Fixed timing attacks against echo-off password entry (bsc#1227318).\n\nOther fixes:\n- Add obsoletes for openssh-server-config-rootlogin (bsc#1227350).\n- Add #include \u003cstdlib.h\u003e in some files added by the ldap patch to\n  fix build with gcc14 (bsc#1225904).\n- Remove the recommendation for openssh-server-config-rootlogin\n  from openssh-server (bsc#1224392).\n","status":"published","published":"2024-07-10T15:33:48Z","modified":"2026-02-04T03:40:21.254463Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2025:20009-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\n- CVE-2024-39894: Fixed timing attacks against echo-off password entry (bsc#1227318)\n- CVE-2024-6387: Fixed race condition in a signal handler (bsc#1226642).\n","status":"published","published":"2025-02-03T08:47:06Z","modified":"2026-03-23T04:50:01.776068Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-6887-1","title":"openssh vulnerability","description":"Philippos Giavridis, Jacky Wei En Kung, Daniel Hugenroth, and Alastair\nBeresford discovered that the OpenSSH ObscureKeystrokeTiming feature did\nnot work as expected. A remote attacker could possibly use this issue to\ndetermine timing information about keystrokes.\n","status":"published","published":"2024-07-09T14:04:56Z","modified":"2026-02-10T04:44:21Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}