CVE-2016-20012: Medium severity OpenBSD OpenSSH vulnerability
DISPUTED OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this OpenSSH vulnerability?
The vulnerability ID is CVE-2016-20012.
What is the severity rating of CVE-2016-20012?
The severity rating of CVE-2016-20012 is medium with a score of 5.3.
How does this vulnerability in OpenSSH manifest?
This vulnerability allows remote attackers to test the validity of a certain combination of username and public key in an SSH server.
Which versions of OpenSSH are affected by CVE-2016-20012?
OpenSSH up to version 8.7 is affected by CVE-2016-20012.
Is there a fix for this vulnerability?
Yes, the fix for this vulnerability can be found in the OpenSSH source code.