Описание
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.
A flaw was found in OpenSSH's Secure Shell Daemon (sshd). This vulnerability allows a remote attacker to cause a denial of service by initiating an excessive number of authentication attempts. The issue arises from the mishandling of the MaxAuthTries setting specifically when using GSSAPIAuthentication, leading to resource exhaustion.
Отчет
This Moderate impact denial of service flaw in OpenSSH's sshd daemon arises from improper handling of MaxAuthTries during GSSAPI authentication attempts. Exploitation requires GSSAPIAuthentication to be explicitly enabled, which is not the default configuration in Red Hat Enterprise Linux and other affected Red Hat products, thereby limiting the attack surface in typical deployments.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | openssh | Fix deferred | ||
| Red Hat Enterprise Linux 7 | openssh | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | openssh | Fixed | RHSA-2026:85847 | 20.10.2026 |
| Red Hat Enterprise Linux 8 | openssh | Fixed | RHSA-2026:88211 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | openssh | Fixed | RHSA-2026:88211 | 22.10.2026 |
| Red Hat Enterprise Linux 9 | openssh | Fixed | RHSA-2026:85958 | 20.10.2026 |
| Red Hat Enterprise Linux 9 | openssh | Fixed | RHSA-2026:85958 | 20.10.2026 |
| Red Hat Hardened Images | openssh-main-10.4p1-1.hum1 | Fixed | RHSA-2026:37382 | 09.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial ...
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.
EPSS
5.9 Medium
CVSS3