CVE-2016-8858

The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests. NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."

Database specific

{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:openbsd:openssh:7.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:openbsd:openssh:7.2:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "last_affected":  "7.1"
                },
                {
                    "last_affected":  "7.2"
                }
            ],
            "source":  "CPE_FIELD",
            "vendor_product":  "openbsd:openssh"
        }
    ]
}

References

CVE-2016-8858

Affected packages