CVE-2016-6515

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote…

published August 7, 2016

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.1th percentile for exploit probability.

CVSS
—
EPSS
59%
Percentile
99.1
In the wild
Unconfirmed
What it is

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.58568 · 99.1th percentile
Published
2016-08-07T00:00Z
EPSS history
Timeline
  • 22 SEP 03:13Z
    EPSS moved 59% → 46%
    epss
  • 06 SEP 03:09Z
    EPSS moved 59% → 46%
    epss
  • 30 AUG 15:34Z
    EPSS moved 46% → 59%
    epss
  • 29 AUG 04:13Z
    EPSS moved 59% → 46%
    epss
  • 07 AUG 00:00Z
    The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote…
    cvelistv5