Bug 2166785 - openssh: Pre-authentication double free
Summary: openssh: Pre-authentication double free
Keywords:
Status: CLOSED DUPLICATE of bug 2167636
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2166917
TreeView+ depends on / blocked
 
Reported: 2023-02-02 23:04 UTC by Pedro Sampaio
Modified: 2023-03-02 07:29 UTC (History)
21 users (show)

Fixed In Version: openssh 9.2
Clone Of:
Environment:
Last Closed: 2023-03-02 07:29:53 UTC
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2023-02-02 23:04:30 UTC 
A pre-authentication double free was found specifically in OpenSSH 9.1 server component that can lead to remote denial of service.

References:

https://www.openssh.com/releasenotes.html
https://www.openwall.com/lists/oss-security/2023/02/02/2

Upstream bug:

https://bugzilla.mindrot.org/show_bug.cgi?id=3522

Introducing commit:

https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946
Comment 2 Sandipan Roy 2023-03-02 07:29:53 UTC 

*** This bug has been marked as a duplicate of bug 2167636 ***
Note You need to log in before you can comment on or make changes to this bug.