Vulnerability · Published Jul 2, 2024 · Assigned by mitre
CVE-2024-39894
High 7.5
In plain English
A high-severity security flaw in the openssh package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.6%top 23.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | openssh | 1:9.8p1-1 | DEBIAN-CVE-2024-39894 |
| Debian:14 | openssh | 1:9.8p1-1 | DEBIAN-CVE-2024-39894 |
| Ubuntu:24.04:LTS | openssh | 1:9.6p1-3ubuntu13.4 | USN-6887-1 |
| Ubuntu:24.04:LTS | openssh | 1:9.6p1-3ubuntu13.4 | UBUNTU-CVE-2024-39894 |
Affected products (as reported)
Weakness: CWE-367 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://www.openssh.com/txt/release-9.8
- https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html
- https://www.openwall.com/lists/oss-security/2024/07/02/1
- [oss-security] 20240703 Re: Announce: OpenSSH 9.8 released mailing-list
- https://security.netapp.com/advisory/ntap-20240712-0004/
- [oss-security] 20240723 Re: linux-distros application for CentOS Project's Hyperscale SIG mailing-list
- [oss-security] 20240723 Re: linux-distros application for CentOS Project's Hyperscale SIG mailing-list
- [oss-security] 20240728 Re: Announce: OpenSSH 9.8 released mailing-list
- https://crzphil.github.io/posts/ssh-obfuscation-bypass/
- https://news.ycombinator.com/item?id=41508530
- https://www.freebsd.org/security/advisories/FreeBSD-SA-25:01.openssh.asc
- http://seclists.org/fulldisclosure/2024/Sep/33