CVE-2016-6515

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*"
            ],
            "source": "CPE_FIELD",
            "vendor_product": "fedoraproject:fedora",
            "extracted_events": [
                {
                    "last_affected": "24"
                }
            ]
        },
        {
            "cpes": [
                "cpe:2.3:a:openbsd:openssh:*:p2:*:*:*:*:*:*"
            ],
            "vendor_product": "openbsd:openssh",
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "7.2"
                }
            ]
        }
    ]
}

References

CVE-2016-6515

Affected packages