Skip to content

Product

debian/libpam-ssh vulnerabilities

2 published CVES affecting debian/libpam-ssh, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest debian/libpam-ssh CVEs

Newest publication first

  1. CVE-2009-1273 pam_ssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether the username is valid or invalid, which makes it easier for...

    Published
    MediumCVSS 5.0 EPSS 1.3%

    pam_ssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames.

  2. CVE-2007-0844 The auth_via_key function in pam_ssh.c in pam_ssh before 1.92, when the allow_blank_passphrase option is disabled, allows remote attackers to bypass authentication restrictions and use private encrypt...

    Published
    MediumCVSS 6.4 EPSS 0.88%

    The auth_via_key function in pam_ssh.c in pam_ssh before 1.92, when the allow_blank_passphrase option is disabled, allows remote attackers to bypass authentication restrictions and use private encryption keys requiring a blank passphrase by entering a non-blank passphrase.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.