CVE-2024-39894
Fixed in a distro release EPSS 2%CVSS 7.5
OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.
Products: openbsd openssh
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 13 | openssh | 1:9.8p1-1 |
| Debian 14 | openssh | 1:9.8p1-1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | openssh | 9.6p1-150600.6.6.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP6 | openssh-askpass-gnome | 9.6p1-150600.6.6.1 |
| SUSE Linux Micro 6.0 | openssh | 9.6p1-2.1 |
| Ubuntu 24.04 LTS | openssh | 1:9.6p1-3ubuntu13.4 |
| openSUSE Leap 15.6 | openssh | 9.6p1-150600.6.6.1 |
| openSUSE Leap 15.6 | openssh-askpass-gnome | 9.6p1-150600.6.6.1 |
| openSUSE Tumbleweed | openssh | 9.6p1-11.1 |