CVE-2016-8858

The kexinputkexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests. NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_FIELD",
            "vendor_product": "openbsd:openssh",
            "extracted_events": [
                {
                    "last_affected": "7.1"
                },
                {
                    "last_affected": "7.2"
                }
            ],
            "cpes": [
                "cpe:2.3:a:openbsd:openssh:7.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:openbsd:openssh:7.2:*:*:*:*:*:*:*"
            ]
        }
    ]
}

References

CVE-2016-8858

Affected packages