CVE-2019-16905

תיאור (מקור, אנגלית)

OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.

מדדים

CVSS 3.1

7.8 (HIGH) מקור הציון: NVD CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — סבירות ניצול

2% (אחוזון 100) נכון ל-14/10/2026

CWE

CWE-190

מוצרים מושפעים

openbsd: openssh; netapp: cloud backup; netapp: steelstore cloud integrated storage; siemens: scalance x204rna firmware; siemens: scalance x204rna; siemens: scalance x204rna ecc firmware; siemens: scalance x204rna ecc

קישורים

• https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c Release NotesVendor Advisory
• https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c Release NotesVendor Advisory
• https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c.diff?r‮… Patch
• https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c.diff?r‮… Patch
• https://ssd-disclosure.com/archives/4033/ssd-advisory-openssh-pre-auth-xmss-in‮… ExploitThird Party Advisory
• https://ssd-disclosure.com/archives/4033/ssd-advisory-openssh-pre-auth-xmss-in‮… ExploitThird Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1153537 Issue TrackingThird Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf Third Party Advisory
• https://security.gentoo.org/glsa/201911-01 Third Party Advisory
• https://security.netapp.com/advisory/ntap-20191024-0003/ Third Party Advisory