REDHAT-BUG-2436981: Low severity OpenSSH OpenSSH vulnerability
The function matchpattern() is used to match conditionals in client configuration files or known hosts against the hostname the client is connecting to.
When the configuration file or knownhosts file is controlled by the attacker, connecting to specific hostnames could cause timeouts and resource exhaustion due to the ineffective backtracking of complex regular expressions.
The pattern matching was modified to avoid the needless backtracing.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2436981?
The severity of REDHAT-BUG-2436981 is considered critical due to the potential for denial-of-service attacks.
How do I fix REDHAT-BUG-2436981?
To fix REDHAT-BUG-2436981, it is recommended to update to the latest version of OpenSSH that addresses the vulnerability.
Which versions of OpenSSH are affected by REDHAT-BUG-2436981?
REDHAT-BUG-2436981 affects certain implementations of OpenSSH where the configuration files are improperly secured.
What is the impact of REDHAT-BUG-2436981 on systems?
The impact of REDHAT-BUG-2436981 can lead to significant timeouts and resource exhaustion when connecting to specific hostnames.
Are there any workarounds for REDHAT-BUG-2436981?
A possible workaround for REDHAT-BUG-2436981 includes securing the configuration files to ensure they are not under the attacker's control.