CVE-2001-0361 Implementations of SSH version 1.5, including (1) OpenSSH up to version 2.3.0, (2) AppGate, and (3) ssh-1 up to version 1.2.31, in certain configurations, allow a remote attacker to decrypt and/or alt...
MediumCVSS 4.0
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Implementations of SSH version 1.5, including (1) OpenSSH up to version 2.3.0, (2) AppGate, and (3) ssh-1 up to version 1.2.31, in certain configurations, allow a remote attacker to decrypt and/or alter traffic via a "Bleichenbacher attack" on PKCS#1 version 1.5.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenBSD openssh | = 1.2.3 | No fix listed |
| OpenBSD openssh | = 2.1 | No fix listed |
| OpenBSD openssh | = 2.1.1 | No fix listed |
| ssh | <= 1.2.31 | No fix listed |
References
- 20010207 [CORE SDI ADVISORY] SSH1 session key recovery vulnerability mailing-list
- L-047 government-resource third-party-advisory
- DSA-023 vendor-advisory
- DSA-027 vendor-advisory
- DSA-086 vendor-advisory
- SuSE-SA:2001:04 vendor-advisory
- 2116 vdb-entry
- 2344 patch vdb-entry vendor-advisory
- ssh-session-key-recovery(6082) vdb-entry